Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability
CVE-2020-7029

6.4MEDIUM

Key Information:

Vendor

Avaya
Status
Avaya Aura Communication Manager
Avaya Aura Messaging
Vendor
CVE Published:
11 August 2020

What is CVE-2020-7029?

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Avaya Aura Communication Manager 8.0.x

Avaya Aura Communication Manager 7.0 <= 7.1.3.4

Avaya Aura Messaging 7.0 <= 7.1 SP1

References

https://support.avaya.com/css/P8/documents/101070201
x_refsource_CONFIRM

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.