VULNERABILITY INTELLIGENCE

CVE-2019-19616

CVSS score4.3 MEDIUM
EPSS probability0.68%
CISA KEVNot currently listed
Published2019-12-06
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment function.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key

Primary references