PT-2021-16730 · Avaya · Avaya Aura Appliance Virtualization Platform Utilities

Gerardo Iglesias + 1 · Published 2021-06-24 · Updated 2022-10-25 · CVE-2021-25652

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Avaya Aura Appliance Virtualization Platform Utilities (AVPU) versions 8.0.0.0 through 8.1.3.1

Description An information disclosure issue was discovered in the directory and file management of AVPU, potentially allowing any local user to access system functionality and configuration information that should only be available to a privileged user.

Recommendations For versions 8.0.0.0 through 8.1.3.1, update to a version that contains a fix for this issue to prevent unauthorized access to system functionality and configuration information.

Fix

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

CVE-2021-25652

Affected Products

Avaya Aura Appliance Virtualization Platform Utilities

References · 5

• https://osv.dev/vulnerability/CVE-2021-25652 · Vendor Advisory
• https://support.avaya.com/css/P8/documents/101076479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25652 · Security Note
• https://t.me/cvenotify/16911 · Telegram Post
• https://t.me/cibsecurity/25666 · Telegram Post