CVE-2020-7029CWE-352

Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

Medium · published August 11, 2020

CVSS v3.1
6.4
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00434 · 36.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2020-08-11T23:05Z
EPSS history
Timeline
  • 11 AUG 23:05Z
    Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability
    cvelistv5