Lucene search

AvayaCVE-2022-2975

HistoryOct 06, 2022 - 6:15 p.m.

CVE-2022-2975

2022-10-0618:15:59

CWE-269

CWE-732

avaya

web.nvd.nist.gov

cve-2022-2975

avaya aura

application enablement services

vulnerability

weak permissions

administrative user

arbitrary code

root user

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

Affected configurations

Nvd

Node

avayaaura_application_enablement_servicesRange8.0.0.0–8.1.3.5

avayaaura_application_enablement_servicesRange10.1.0.0–10.1.0.2

VendorProductVersionCPE
avayaaura_application_enablement_services*cpe:2.3:a:avaya:aura_application_enablement_services:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
avaya	aura_application_enablement_services	*	cpe:2.3:a:avaya:aura_application_enablement_services::::::::

CNA Affected

[
  {
    "vendor": "Avaya",
    "product": "Avaya Aura Application Enablement Services",
    "versions": [
      {
        "version": "10.1.x",
        "status": "affected",
        "lessThanOrEqual": "10.1.0.1",
        "versionType": "custom"
      },
      {
        "version": "8.x",
        "status": "affected",
        "lessThanOrEqual": "8.1.3.4",
        "versionType": "custom"
      }
    ]
  }
]

References

download.avaya.com/css/public/documents/101083688

Social References

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-2975