8.8
CVE-2020-7029
- EPSS 0.23%
- Published 11.08.2020 23:15:11
- Last modified 21.11.2024 05:36:30
- Source securityalerts@avaya.com
- Teams watchlist Login
- Open Login
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.
Data is provided by the National Vulnerability Database (NVD)
Avaya ≫ Aura Communication Manager Version >= 7.0 <= 7.1.3.4
Avaya ≫ Aura Communication Manager Version >= 8.0 < 8.1.0.0
Avaya ≫ Aura Messaging Version >= 7.0 < 7.1
Avaya ≫ Aura Messaging Version7.1 Update-
Avaya ≫ Aura Messaging Version7.1 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.23% | 0.43 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
| securityalerts@avaya.com | 6.4 | 1.6 | 4.7 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.