Description
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | Progress® Telerik® Fiddler® Everywhere | 1.0.0 – < 8.2.0 | 8.2.0 |