About the vendor:
Kony EMM is a mobile management suite that allows organizations to manage employee's personal devices. It enables users to use their own device, or as often called BYOD or "bring your own device".
About the vulnerability:
During a pentest we discovered that a logged in user can access arbitrary information such as messages and phone information about every phone that's enrolled ot the solution. Often the user's colleagues:
1.) Arbitrary Message retrieval
By using the following URL:
https://<kony_emm>/emm/selfservice/managedevice/getMessageBody?messageId=<message ID>
Where <message ID> is an integer, an attacker can retrieve all messages sent to every mobile enrolled on the system.
2.) Information retrieval
By going to the following URL
https://<kony_emm>/emm/selfservice/devicemgmt/getDeviceInfoTab.htm?requestId=<request_id>&…"
An attacker can retrieve earlier "requests". A request "task" is generated when a person requests more information about his/her phone, such as IMEI numbers, phone, last locations, etc.
Solution:
The vendor was notified, contact the vendor for the patch details
References:
[1] help AG middle East http://www.helpag.com/
[2] Kony https://kony.com/