Cross site request forgery (csrf)

2019-03-2116:01:00

PRIOn knowledge base

www.prio-n.com

9 High

AI Score

Confidence

High

0.068 Low

EPSS

Percentile

93.9%

JSON

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.

CPENameOperatorVersion
nervepoint_access_managereq1.2 rg3
nervepoint_access_managereq1.2 rg4
nervepoint_access_managereq1.2 rg5
nervepoint_access_managereq1.2 rg6
nervepoint_access_managereq1.2 rg7
nervepoint_access_managereq1.2 rg8
nervepoint_access_managereq1.2 rg9
nervepoint_access_managereq1.2 rg10
nervepoint_access_managereq1.4 rg
nervepoint_access_managereq1.4 rg1

Name	Operator	Version
nervepoint_access_manager	eq	1.2 rg3
nervepoint_access_manager	eq	1.2 rg4
nervepoint_access_manager	eq	1.2 rg5
nervepoint_access_manager	eq	1.2 rg6
nervepoint_access_manager	eq	1.2 rg7
nervepoint_access_manager	eq	1.2 rg8
nervepoint_access_manager	eq	1.2 rg9
nervepoint_access_manager	eq	1.2 rg10
nervepoint_access_manager	eq	1.4 rg
nervepoint_access_manager	eq	1.4 rg1