PT-2018-17687 · Avaya · Avaya Aura

Published 2018-02-05 · Updated 2019-10-03 · CVE-2018-6635

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avaya Aura versions prior to 7.1.2

Description The issue concerns the System Manager in Avaya Aura, where it does not properly use SSL in conjunction with authentication. This allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions.

Recommendations For versions prior to 7.1.2, update to version 7.1.2 or later to resolve the issue.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2018-6635

Affected Products

Avaya Aura

References · 5

• https://osv.dev/vulnerability/CVE-2018-6635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6635 · Security Note
• https://downloads.avaya.com/css/P8/documents/101038598 · Vendor Advisory
• http://securityfocus.com/bid/102940 · Note
• http://securitytracker.com/id/1040329 · Note