Medium severity4.3NVD Advisory· Published Dec 6, 2019· Updated Jun 17, 2026

CVE-2019-19616

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Xtivia/Web Time And Expense
cpe:2.3:a:xtivia:web_time_and_expense:*:*:*:*:*:dynamics_365:*:*
Range: <2017
Xtivia/Web Time and Expensedescription
Microsoft/Dynamics Navllm-fuzzy
Range: < 2017
Xtivia/Web Time and Expense (WebTE)llm-fuzzy
Range: < 2017

Patches

Vulnerability mechanics

References

www.nolanbkennedy.com/post/insecure-direct-object-reference-idor-in-xtivia-web-time-and-expense-webtenvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000