PT-2009-2175 · Avaya · Avaya Communication Manager+1
Published
2009-04-10
·
Updated
2017-08-17
·
CVE-2008-6706
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Avaya SIP Enablement Services (SES) versions 3.x through 4.0
Avaya Communication Manager versions 3.1.x
Description
The issue allows remote attackers to obtain sensitive information, including application server configuration, database server configuration with encrypted passwords, and access to system utilities for decrypting and encrypting passwords.
Recommendations
For Avaya SIP Enablement Services (SES) versions 3.x through 4.0, restrict access to the Web management interface to minimize the risk of exploitation.
For Avaya Communication Manager versions 3.1.x, consider disabling remote access to the management interface until a fix is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Avaya Communication Manager
Avaya Sip Enablement Services