Description
Kony Management (aka Enterprise Mobile Management or EMM) 1.2 and earlier allows remote authenticated users to read (1) arbitrary messages via the messageId parameter to selfservice/managedevice/getMessageBody or (2) requests via the requestId parameter to selfservice/devicemgmt/getDeviceInfoTab.htm.
References
- 20150222 CVE-2014-8487: Kony EMM insecurity Direct Object Reference mailing-list
- 72714 vdb-entry