CVE-2020-7029mediumCWE-352

CVE-2020-7029: medium-severity vulnerability in Avaya Aura Communication Manager

Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

Published · Updated

Follow this CVE+ Monitor Avaya Aura Communication Manager+ Monitor Avaya Aura Messaging

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.4epss 0.4%
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
Affected products
Avaya · Avaya Aura Communication ManagerAvaya · Avaya Aura Messaging
Related CVEs — Avaya Aura Communication Manager

In the same product, most dangerous first.

CVE-2022-2249HIGHAvaya Aura Communication Manager Privilege Escalation VulnerabilitiesEPSS 0.2%