CVE-2014-8487

Name of the Vulnerable Software and Affected Versions Kony Management (aka Enterprise Mobile Management or EMM) versions 1.2 and earlier

Description The issue allows remote authenticated users to read arbitrary messages or requests. This can be achieved via the messageId parameter to the "selfservice/managedevice/getMessageBody" API endpoint or the requestId parameter to the "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoint.

Recommendations For versions 1.2 and earlier, consider restricting access to the "selfservice/managedevice/getMessageBody" and "selfservice/devicemgmt/getDeviceInfoTab.htm" API endpoints to minimize the risk of exploitation. Avoid using the messageId and requestId parameters in these endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.