CVE Vulnerability

CVE-2019-7003

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

6.4 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

10 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://downloads.avaya.com/css/P8/documents/101059368 Vendor Advisory
https://support.avaya.com/documents/documents-by-contenttype.action?product_id=P0941&product_name=Control+Manager&release_number=releaseId&contentType=ReleaseNotes Release Notes Vendor Advisory
http://www.securityfocus.com/bid/109134 Broken Link Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:avaya:control_manager:*:*:*:*:*:*:*:*
Information

Published : 2019-07-11 07:15

Updated : 2023-02-03 02:31

NVD link : CVE-2019-7003

Mitre link : CVE-2019-7003

Products Affected
No products.
CWE
CWE-89