BlackBerry AtHoc Insecure Direct Object Reference Vulnerability in Management Console

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Management Console of BlackBerry AtHoc (OnPrem) version 7.21. This vulnerability could enable an authenticated operator to gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS).

Impact

Exploitation of this vulnerability could lead to unauthorized access to information about other organizations on the same IWS.

Remediation

Users should contact BlackBerry Customer Support or Professional Services to obtain the latest update. The patched version is BlackBerry AtHoc (OnPrem) 7.21 HF-727 build 1255.