8.8

CVE-2020-7029

Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Avaya ≫ Aura Communication Manager Version >= 7.0 <= 7.1.3.4
Avaya ≫ Aura Communication Manager Version >= 8.0 < 8.1.0.0
Avaya ≫ Aura Messaging Version >= 7.0 < 7.1
Avaya ≫ Aura Messaging Version 7.1 Update -
Avaya ≫ Aura Messaging Version 7.1 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.345
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
securityalerts@avaya.com 6.4 1.6 4.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://support.avaya.com/css/P8/documents/101070201
Vendor Advisory