Avaya IPOCC WebUI SQL Injection

CVE-2019-7001

9.9CRITICAL

Key Information

Vendor
Avaya
Status
Ip Office Contact Center
Vendor
CVE Published:
4 April 2019

Summary

A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and 10.x versions prior to 10.1.2.2.2-11201.1908. Unsupported versions not listed here were not evaluated.

Affected Version(s)

IP Office Contact Center = 10.0.x 10.x

IP Office Contact Center = 9.x

IP Office Contact Center < 10.1.2.2.2-11201.1908

References

https://downloads.avaya.com/css/P8/documents/101056762
x_refsource_CONFIRM

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.