CVE-2020-7029mediumCWE-352

CVE-2020-7029: fallo de gravedad media en Avaya Aura Communication Manager

Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Avaya Aura Communication Manager+ Monitorear Avaya Aura Messaging

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.4epss 0.4%
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
Productos afectados
Avaya · Avaya Aura Communication ManagerAvaya · Avaya Aura Messaging
CVEs relacionadas — Avaya Aura Communication Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-2249HIGHAvaya Aura Communication Manager Privilege Escalation VulnerabilitiesEPSS 0.2%