CVE-2019-6716

CRITICAL

LogonBox Limited / Hypersocket Nervepoint Access Manager - (Unauthenticated) Insecure Direct Object Reference

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-6716 has a selected CVSS score of 9.4 (critical); EIP currently links 1 catalogued exploit.

Description

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBLogonBox Limited / Hypersocket Nervepoint Access Manager - (Unauthenticated) Insecure Direct Object ReferenceExploitDB exploitby 0v3rrideNot analyzed1 file
ExploitDB
PoC details

References

4