CVEvulnerability
CVE-2019-6716
9.4 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-03-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.4 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-639
Description
An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.
Affected configurations
• logonbox nervepoint access manager 1.2
• logonbox nervepoint access manager 1.3
• logonbox nervepoint access manager 1.4
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- http://packetstormsecurity.com/files/151373/LongBox-Limited-Access-Manager-Insecure-Direct-Object-Reference.html Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46254/ Third Party Advisory, VDB Entry
- https://www.logonbox.com/en/ Product
- http://packetstormsecurity.com/files/151373/LongBox-Limited-Access-Manager-Insecure-Direct-Object-Reference.html Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/46254/ Third Party Advisory, VDB Entry
- https://www.logonbox.com/en/ Product