Vulners
Lucene search
Avaya IP Office 11 Insecure Transit / Password Disclosure Vulnerability
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | CVE-2020-7030 | 28 Oct 202414:39 | – | circl |
 | Avaya IP Office Information Disclosure Vulnerability | 4 Jun 202000:00 | – | cnvd |
 | CVE-2020-7030 | 3 Jun 202023:45 | – | cve |
 | CVE-2020-7030 IPO Information Disclosure | 3 Jun 202023:45 | – | cvelist |
 | Avaya IP Office 11 - Password Disclosure | 12 Jun 202000:00 | – | exploitdb |
 | EUVD-2020-28164 | 7 Oct 202500:30 | – | euvd |
 | CVE-2020-7030 | 4 Jun 202000:15 | – | nvd |
 | Avaya IP Office 9.x < 10.1.0.8, 11.0 < 11.0.4.3 Information Disclosure Vulnerability | 9 Jun 202000:00 | – | openvas |
 | Avaya IP Office 11 Insecure Transit / Password Disclosure | 5 Jun 202000:00 | – | packetstorm |
 | Information disclosure | 4 Jun 202000:15 | – | prion |
10
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source: http://hyp3rlinx.altervista.org/advisories/AVAYA-IP-OFFICE-INSECURE-TRANSIT-PASSWORD-DISCLOSURE.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec
[Vendor]
www.avaya.com
[Product]
Avaya IP Office v9.1.8.0 - 11
IP Office Platform provides a single, stackable, scalable small business communications system that grows with your business easily and cost-effectively.
[Vulnerability Type]
Insecure Transit Password Disclosure
[CVE Reference]
CVE-2020-7030
ASA-2020-077
[Security Issue]
A sensitive information disclosure vulnerability exists in the web interface component of IP Office that
may potentially allow a local user to gain unauthorized access to the component.
The request URL on port 7071 and the web socket component requests on port 7070 used by Atmosphere-Framework
within Avaya IP Office, pass Base64 encoded credentials as part of the URL query string.
https://<TARGET-IP>:7071/serveredition/autologin?auth=QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y&referrer=https://x.x.x.x:7070&lang=en_US
wss://<TARGET-IP>:7070/WebManagement/webmanagement/atmosphere/QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y?X-Atmosphere-tracking-id=0&
X-Atmosphere-Framework=2.0.5-javascript&X-Atmosphere-Transport=websocket&X-Cache-Date=0&Content-Type=text/x-gwt-rpc;%20charset=UTF-8&X-atmo-protocol=true
Base64 credentials: QWRtaW5pc3RyYXRvcjpBZG1pbmlzdHJhdG9y
Value: Administrator:Administrator
The Base64 encoded credentials can be easily disclosed if the machine used to logon to the web Manager is accessed by an attacker.
The URL plus the credentials can potentially be leaked or stored in some of the following locations.
Browser History
Browser Cache
Browser Developer Tools
Cached by web proxy
Referer Header
Web Logs
Shared Systems
[Avaya Products affected]
Avaya IP Office 9.x, 10.0 through 10.1.0.7, 11.0 through 11.0.4.2
[References]
https://downloads.avaya.com/css/P8/documents/101067493
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Jun 2020 00:00Current
5.6Medium risk
Vulners AI Score5.6
CVSS 22.1
CVSS 3.15.5
EPSS0.00898