PT-2020-19347 · Avaya · Avaya Ip Office

Hyp3Rlinx + 1 · Published 2020-06-03 · Updated 2020-06-09 · CVE-2020-7030

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avaya IP Office versions 9.x through 11.0.4.3

Description A sensitive information disclosure vulnerability was discovered in the web interface component of Avaya IP Office, potentially allowing a local user to gain unauthorized access to the component. This issue may lead to password disclosure.

Recommendations For versions 9.x through 11.0.4.3, consider restricting access to the web interface component until a patch is available. As a temporary workaround, disabling the web interface component may help minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

CVE-2020-7030

Affected Products

Avaya Ip Office

References · 9

• 🔥 https://exploit-db.com/exploits/48581 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7030 · Vendor Advisory
• https://downloads.avaya.com/css/P8/documents/101067493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7030 · Security Note
• http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html · Note
• http://seclists.org/fulldisclosure/2020/Jun/12 · Note
• https://t.me/cvenotify/4187 · Telegram Post
• https://t.me/defcon_news/49196 · Telegram Post
• https://t.me/cybersecuritytechnologies/1227 · Telegram Post