Lucene search

[email protected]CVE-2008-6708

HistoryApr 10, 2009 - 10:00 p.m.

CVE-2008-6708

2009-04-1022:00:00

[email protected]

web.nvd.nist.gov

cve

avaya

sip enablement services

vulnerability

web management

root privileges

remote authentication

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.0%

JSON

Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x and 4.x, allows remote authenticated administrators to gain root privileges via unknown vectors related to configuration of “data viewing or restoring parameters.”

Affected configurations

NVD

Node

avayacommunication_managerMatch3.1

avayacommunication_managerMatch3.1.1

avayacommunication_managerMatch3.1.2

avayacommunication_managerMatch3.1.3

avayacommunication_managerMatch3.1.4

avayacommunication_managerMatch3.1.5

avayacommunication_managerMatch4.0

avayacommunication_managerMatch4.0.1

avayacommunication_managerMatch4.0.1sp15215

avayacommunication_managerMatch4.0.1sp15500

avayacommunication_managerMatch4.0.3

avayasip_enablement_servicesMatch3.0

CPENameOperatorVersion
avaya:communication_manageravaya communication managereq3.1
avaya:communication_manageravaya communication managereq3.1.1
avaya:communication_manageravaya communication managereq3.1.2
avaya:communication_manageravaya communication managereq3.1.3
avaya:communication_manageravaya communication managereq3.1.4
avaya:communication_manageravaya communication managereq3.1.5
avaya:communication_manageravaya communication managereq4.0
avaya:communication_manageravaya communication managereq4.0.1
avaya:communication_manageravaya communication managereq4.0.3
avaya:sip_enablement_servicesavaya sip enablement serviceseq3.0

CPE	Name	Operator	Version
avaya:communication_manager	avaya communication manager	eq	3.1
avaya:communication_manager	avaya communication manager	eq	3.1.1
avaya:communication_manager	avaya communication manager	eq	3.1.2
avaya:communication_manager	avaya communication manager	eq	3.1.3
avaya:communication_manager	avaya communication manager	eq	3.1.4
avaya:communication_manager	avaya communication manager	eq	3.1.5
avaya:communication_manager	avaya communication manager	eq	4.0
avaya:communication_manager	avaya communication manager	eq	4.0.1
avaya:communication_manager	avaya communication manager	eq	4.0.3
avaya:sip_enablement_services	avaya sip enablement services	eq	3.0

References

osvdb.org/46604

secunia.com/advisories/30751

support.avaya.com/elmodocs2/security/ASA-2008-268.htm

www.securityfocus.com/bid/29939

www.voipshield.com/research-details.php?id=77

www.vupen.com/english/advisories/2008/1943/references

exchange.xforce.ibmcloud.com/vulnerabilities/43390

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

6.7 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.0%

JSON

Related for CVE-2008-6708

cvelist1 prion1 nvd1