Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
Tactis' NoviGest Desktop App is affected by a missing authentication flaw in its Java RMI service, which lets a network attacker call sensitive functions without logging in. Successful exploitation could expose credentials, allow arbitrary database queries, and enable commands to run on the underlying server, compromising its confidentiality, integrity, and availability.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Affected versions
- Tactis NoviGest Desktop App
NoviGest Desktop App prior to version 8.0.0-300