Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2019-6716
HistoryMar 21, 2019 - 4:01 p.m.

CVE-2019-6716

2019-03-2116:01:09
CWE-639
mitre
web.nvd.nist.gov
28
cve
2019
6716
insecure direct object reference
idor
logonbox
nervepoint access manager
active directory
denial of service
job modification
wicket core

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.054

Percentile

93.3%

JSON

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.

Affected configurations

Nvd
Node
logonboxnervepoint_access_managerMatch1.2rg10
OR
logonboxnervepoint_access_managerMatch1.2rg3
OR
logonboxnervepoint_access_managerMatch1.2rg4
OR
logonboxnervepoint_access_managerMatch1.2rg5
OR
logonboxnervepoint_access_managerMatch1.2rg6
OR
logonboxnervepoint_access_managerMatch1.2rg7
OR
logonboxnervepoint_access_managerMatch1.2rg8
OR
logonboxnervepoint_access_managerMatch1.2rg9
OR
logonboxnervepoint_access_managerMatch1.3rg
OR
logonboxnervepoint_access_managerMatch1.3rg1
OR
logonboxnervepoint_access_managerMatch1.3rg2
OR
logonboxnervepoint_access_managerMatch1.3rg3
OR
logonboxnervepoint_access_managerMatch1.3rg4
OR
logonboxnervepoint_access_managerMatch1.3rg5
OR
logonboxnervepoint_access_managerMatch1.3rg6
OR
logonboxnervepoint_access_managerMatch1.3rg7
OR
logonboxnervepoint_access_managerMatch1.3rg8
OR
logonboxnervepoint_access_managerMatch1.4rg
OR
logonboxnervepoint_access_managerMatch1.4rg1
OR
logonboxnervepoint_access_managerMatch1.4rg2
OR
logonboxnervepoint_access_managerMatch1.4rg3
VendorProductVersionCPE
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg10:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg3:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg4:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg5:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg6:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg7:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg8:*:*:*:*:*:*
logonboxnervepoint_access_manager1.2cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg9:*:*:*:*:*:*
logonboxnervepoint_access_manager1.3cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg:*:*:*:*:*:*
logonboxnervepoint_access_manager1.3cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg1:*:*:*:*:*:*
Rows per page:
1-10 of 211

Related

packetstorm 1
prion 1
cvelist 1
zdt 1
nvd 1
exploitdb 1
packetstorm
packetstorm
LongBox Limited Access Manager Insecure Direct Object Reference
2019-01-29 00:00:00
prion
prion
Cross site request forgery (csrf)
2019-03-21 16:01:00
cvelist
cvelist
CVE-2019-6716
2019-03-17 17:50:43
zdt
zdt
LogonBox Limited / Hypersocket Nervepoint Access Manager - Unauthenticated Insecure
2019-01-28 00:00:00
nvd
nvd
CVE-2019-6716
2019-03-21 16:01:09
exploitdb
exploitdb
LogonBox Limited / Hypersocket Nervepoint Access Manager - (Unauthenticated) Insecure Direct Object Reference
2019-01-28 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

AI Score

9

Confidence

High

EPSS

0.054

Percentile

93.3%

JSON
Related for CVE-2019-6716
packetstorm1prion1cvelist1zdt1nvd1exploitdb1