PT-2018-13116 · Avaya · Avaya Ip Office

Pedro Andujar · Published 2018-09-12 · Updated 2019-10-03 · CVE-2018-15610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Avaya IP Office versions 9.1 through 9.1 SP12 Avaya IP Office versions 10.0 through 10.0 SP7 Avaya IP Office versions 10.1 through 10.1 SP2

Description A vulnerability in the one-X Portal component allows an authenticated attacker to read and delete arbitrary files on the system.

Recommendations For Avaya IP Office versions 9.1 through 9.1 SP12, update to a version outside of this range to resolve the issue. For Avaya IP Office versions 10.0 through 10.0 SP7, update to a version outside of this range to resolve the issue. For Avaya IP Office versions 10.1 through 10.1 SP2, update to a version outside of this range to resolve the issue.

Fix

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

CVE-2018-15610

Affected Products

Avaya Ip Office

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15610 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15610 · Vendor Advisory
• https://downloads.avaya.com/css/P8/documents/101051984 · Vendor Advisory
• https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html · Note