Progress Telerik Fiddler Everywhere
Monthly
Progress Software Fiddler Everywhere 8.0.2 ships a local .NET backend (Fiddler.WebUi) that exposes an HTTP and SignalR RPC endpoint on the loopback interface without any authentication, allowing any local user or process on the same machine to call privileged methods, mint OAuth tokens, and export the application's machine-in-the-middle root certificate. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7) and only exploitable while Fiddler Everywhere is installed and running, but it requires no credentials or user interaction once those conditions hold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the practical risk is credential and trust-anchor theft on shared workstations or hosts where untrusted local software can execute.
Local abuse of privileged IPC in Progress Telerik Fiddler Everywhere before 8.2.0 lets a low-privileged, locally authenticated attacker who can tamper with the application's launch parameters - and then persuade the victim to actually start the app - substitute attacker-controlled UI or settings content for the genuine ones. That foothold can expose OAuth authentication tokens, execute locally reachable programs, or silently rewrite application-generated configuration files, with high confidentiality impact and limited integrity impact but no availability impact. No public exploit identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score of 5.6 reflects the strict prerequisites of local access plus user interaction, making this a developer-workstation-scoped risk rather than an urgent, remotely reachable one.
Progress Software Fiddler Everywhere 8.0.2 ships a local .NET backend (Fiddler.WebUi) that exposes an HTTP and SignalR RPC endpoint on the loopback interface without any authentication, allowing any local user or process on the same machine to call privileged methods, mint OAuth tokens, and export the application's machine-in-the-middle root certificate. The issue is strictly local (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7) and only exploitable while Fiddler Everywhere is installed and running, but it requires no credentials or user interaction once those conditions hold. There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the practical risk is credential and trust-anchor theft on shared workstations or hosts where untrusted local software can execute.
Local abuse of privileged IPC in Progress Telerik Fiddler Everywhere before 8.2.0 lets a low-privileged, locally authenticated attacker who can tamper with the application's launch parameters - and then persuade the victim to actually start the app - substitute attacker-controlled UI or settings content for the genuine ones. That foothold can expose OAuth authentication tokens, execute locally reachable programs, or silently rewrite application-generated configuration files, with high confidentiality impact and limited integrity impact but no availability impact. No public exploit identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 base score of 5.6 reflects the strict prerequisites of local access plus user interaction, making this a developer-workstation-scoped risk rather than an urgent, remotely reachable one.