PT-2015-4048 · Kony · Kony Management

Publicado 2015-02-24 · Atualizado 2018-10-09 · CVE-2014-8487

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kony Management (aka Enterprise Mobile Management or EMM) versions 1.2 and earlier

Description The issue allows remote authenticated users to read arbitrary messages or requests. This can be achieved via the messageId parameter to the "selfservice/managedevice/getMessageBody" API endpoint or the requestId parameter to the "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoint.

Recommendations For versions 1.2 and earlier, consider restricting access to the "selfservice/managedevice/getMessageBody" and "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoints to minimize the risk of exploitation. Avoid using the messageId and requestId parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-8487

Produtos afetados

Kony Management

Referências · 3

• 🔥 http://securityfocus.com/bid/72714 · Exploit
• http://securityfocus.com/archive/1/534739/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8487 · Nota de Segurança