PT-2009-2176 · Avaya · Avaya Communication Manager+1
Published
2009-04-10
·
Updated
2017-08-17
·
CVE-2008-6707
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Avaya SIP Enablement Services (SES) versions 3.x through 4.0
Avaya Communication Manager version 3.1.x
Description
The issue concerns the Web management interface, which fails to perform authentication for certain functionality. This allows remote attackers to obtain sensitive information and access restricted functionality via various means, including the certificate installation utility, unspecified scripts in the objects and states folders, an unnecessary default application, an unspecified default application that lists server configuration, and full system help.
Recommendations
For Avaya SIP Enablement Services (SES) versions 3.x through 4.0, consider restricting access to the Web management interface until a fix is available.
For Avaya Communication Manager version 3.1.x, restrict access to the Web management interface and consider disabling unnecessary default applications and scripts in the objects and states folders until a patch is applied.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Avaya Communication Manager
Avaya Sip Enablement Services