PT-2015-4048 · Kony · Kony Management

Published 2015-02-24 · Updated 2018-10-09 · CVE-2014-8487

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kony Management (aka Enterprise Mobile Management or EMM) versions 1.2 and earlier

Description The issue allows remote authenticated users to read arbitrary messages or requests. This can be achieved via the messageId parameter to the "selfservice/managedevice/getMessageBody" API endpoint or the requestId parameter to the "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoint.

Recommendations For versions 1.2 and earlier, consider restricting access to the "selfservice/managedevice/getMessageBody" and "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoints to minimize the risk of exploitation. Avoid using the messageId and requestId parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-8487

Affected Products

Kony Management

References · 3

• 🔥 http://securityfocus.com/bid/72714 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8487 · Security Note
• http://securityfocus.com/archive/1/534739/100/0/threaded · Note