Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.
Vendor
amtelco vulnerabilities
2 published CVES affecting amtelco, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 1
- Unscored
- 0
- CISA KEV
- 0
Products
Latest amtelco CVEs
Newest publication first
-
LowCVSS 3.5 EPSS 2.3%
-
MediumCVSS 5.0 EPSS 1.8%
Amtelco miSecureMessages allows remote attackers to read the messages of arbitrary users via an XML request containing a valid license key and a modified contactID value, as demonstrated by a request from the iOS or Android application.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.