Improper access controls in IP Office one-X Portal

CVE-2018-15610

7.3HIGH

Key Information

Vendor
Avaya
Status
Ip Office
Vendor
CVE Published:
12 September 2018

Summary

A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.

Affected Version(s)

IP Office = 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2

References

https://downloads.avaya.com/css/P8/documents/101051984
x_refsource_CONFIRM
https://packetstormsecurity.com/files/149284/Avaya-one-X-...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.