CVE-2019-6716

Published: Mar 21, 2019Modified: Jun 17, 2026

9.4

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Exploitability: 3.9 / Impact: 5.5

Source: NVD

Description

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.

Affected (21)

Products: Logonbox: Nervepoint Access Manager

Logonbox

1 product

Nervepoint Access Manager

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Logonbox Nervepoint Access Manager	Version 1.2 rg10
Logonbox Nervepoint Access Manager	Version 1.2 rg3
Logonbox Nervepoint Access Manager	Version 1.2 rg4
Logonbox Nervepoint Access Manager	Version 1.2 rg5
Logonbox Nervepoint Access Manager	Version 1.2 rg6
Logonbox Nervepoint Access Manager	Version 1.2 rg7
Logonbox Nervepoint Access Manager	Version 1.2 rg8
Logonbox Nervepoint Access Manager	Version 1.2 rg9
Logonbox Nervepoint Access Manager	Version 1.3 rg1
Logonbox Nervepoint Access Manager	Version 1.3 rg2
Logonbox Nervepoint Access Manager	Version 1.3 rg3
Logonbox Nervepoint Access Manager	Version 1.3 rg4
Logonbox Nervepoint Access Manager	Version 1.3 rg5
Logonbox Nervepoint Access Manager	Version 1.3 rg6
Logonbox Nervepoint Access Manager	Version 1.3 rg7
Logonbox Nervepoint Access Manager	Version 1.3 rg8
Logonbox Nervepoint Access Manager	Version 1.3 rg
Logonbox Nervepoint Access Manager	Version 1.4 rg1
Logonbox Nervepoint Access Manager	Version 1.4 rg2
Logonbox Nervepoint Access Manager	Version 1.4 rg3
Logonbox Nervepoint Access Manager	Version 1.4 rg