CVE-2019-19616 is an Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface for Microsoft Dynamics NAV versions prior to 2017. An authenticated attacker can exploit this by manipulating recId and filename parameters in the /Home/GetAttachment function to download arbitrary files. This vulnerability has a CVSS score of 4.3 (Medium), indicating low attack complexity and potential for limited confidentiality impact, but no integrity or availability impact. There is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, and it has received minimal community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2017CPE matchmatch criteria | cpe:2.3:a:xtivia:web_time_and_expense:*:*:*:*:*:dynamics_365:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.