PT-2018-13116 · Avaya · Avaya Ip Office

Pedro Andujar · Publicado 2018-09-12 · Atualizado 2019-10-03 · CVE-2018-15610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya IP Office versions 9.1 through 9.1 SP12 Avaya IP Office versions 10.0 through 10.0 SP7 Avaya IP Office versions 10.1 through 10.1 SP2

Description A vulnerability in the one-X Portal component allows an authenticated attacker to read and delete arbitrary files on the system.

Recommendations For Avaya IP Office versions 9.1 through 9.1 SP12, update to a version outside of this range to resolve the issue. For Avaya IP Office versions 10.0 through 10.0 SP7, update to a version outside of this range to resolve the issue. For Avaya IP Office versions 10.1 through 10.1 SP2, update to a version outside of this range to resolve the issue.

Correção

Improper Access Control

Path traversal

Enumeração de Fraquezas

CWE-284

CWE-22

Identificadores relacionados

CVE-2018-15610

Produtos afetados

Avaya Ip Office

Referências · 4

• https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15610 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15610 · Aviso do Fabricante
• https://downloads.avaya.com/css/P8/documents/101051984 · Aviso do Fabricante