Kony Enterprise Mobile Management CVE-2014-8487 Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	72714
Class:	Design Error
CVE:	CVE-2014-8487
Remote:	Yes
Local:	No
Published:	Feb 23 2015 12:00AM
Updated:	Feb 23 2015 12:00AM
Credit:	Michael Hendrickx
Vulnerable:
Not Vulnerable:

Kony Enterprise Mobile Management CVE-2014-8487 Multiple Information Disclosure Vulnerabilities

Kony Enterprise Mobile Management is prone to multiple information-disclosure vulnerabilities.

An attacker can exploit these issues to gain access to sensitive information that may lead to further attacks.

Kony Enterprise Mobile Management CVE-2014-8487 Multiple Information Disclosure Vulnerabilities

An attacker can exploit these issues using web browser.

The following example URIs are available:

https://www.example.com/emm/selfservice/managedevice/getMessageBody?messageId=<message ID>

https://www.example.com/emm/selfservice/devicemgmt/getDeviceInfoTab.htm?requestId=<request_id>&..."

Kony Enterprise Mobile Management CVE-2014-8487 Multiple Information Disclosure Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Kony Enterprise Mobile Management CVE-2014-8487 Multiple Information Disclosure Vulnerabilities

References: