Read the docs
TI-2019-04759 Aliases CVE-2019-6716GHSA-gx48-q3wg-hqgq

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox…

Priority MEDIUM 53CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-639.

Summary

An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.

Why it matters now

EPSS 0.09641 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg10:*:*:*:*:*:*1.2 rg10VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg3:*:*:*:*:*:*1.2 rg3VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg4:*:*:*:*:*:*1.2 rg4VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg5:*:*:*:*:*:*1.2 rg5VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg6:*:*:*:*:*:*1.2 rg6VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg7:*:*:*:*:*:*1.2 rg7VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg8:*:*:*:*:*:*1.2 rg8VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg9:*:*:*:*:*:*1.2 rg9VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg:*:*:*:*:*:*1.3 rgVulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg1:*:*:*:*:*:*1.3 rg1VulnerableLogonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg10:*:*:*:*:*:* Versions 1.2 rg10 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg3:*:*:*:*:*:* Versions 1.2 rg3 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg4:*:*:*:*:*:* Versions 1.2 rg4 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg5:*:*:*:*:*:* Versions 1.2 rg5 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg6:*:*:*:*:*:* Versions 1.2 rg6 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg7:*:*:*:*:*:* Versions 1.2 rg7 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg8:*:*:*:*:*:* Versions 1.2 rg8 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.2:rg9:*:*:*:*:*:* Versions 1.2 rg9 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg:*:*:*:*:*:* Versions 1.3 rg Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg1:*:*:*:*:*:* Versions 1.3 rg1 Vulnerable ·Logonbox
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg2:*:*:*:*:*:*1.3 rg2VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg3:*:*:*:*:*:*1.3 rg3VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg4:*:*:*:*:*:*1.3 rg4VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg5:*:*:*:*:*:*1.3 rg5VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg6:*:*:*:*:*:*1.3 rg6VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg7:*:*:*:*:*:*1.3 rg7VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg8:*:*:*:*:*:*1.3 rg8VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg:*:*:*:*:*:*1.4 rgVulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg1:*:*:*:*:*:*1.4 rg1VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg2:*:*:*:*:*:*1.4 rg2VulnerableLogonbox
cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg3:*:*:*:*:*:*1.4 rg3VulnerableLogonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg2:*:*:*:*:*:* Versions 1.3 rg2 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg3:*:*:*:*:*:* Versions 1.3 rg3 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg4:*:*:*:*:*:* Versions 1.3 rg4 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg5:*:*:*:*:*:* Versions 1.3 rg5 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg6:*:*:*:*:*:* Versions 1.3 rg6 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg7:*:*:*:*:*:* Versions 1.3 rg7 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.3:rg8:*:*:*:*:*:* Versions 1.3 rg8 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg:*:*:*:*:*:* Versions 1.4 rg Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg1:*:*:*:*:*:* Versions 1.4 rg1 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg2:*:*:*:*:*:* Versions 1.4 rg2 Vulnerable ·Logonbox
  • cpe:2.3:a:logonbox:nervepoint_access_manager:1.4:rg3:*:*:*:*:*:* Versions 1.4 rg3 Vulnerable ·Logonbox

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-6716
  2. 2026-10-03 Alias added: GHSA-gx48-q3wg-hqgq

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences