CVE-2022-2975CWE-269

Avaya Aura Application Enablement Services weak permissions in web application

High · published October 6, 2022

CVSS v3.1
7.7
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2022-10-06T00:00Z
EPSS history
Timeline
  • 06 OCT 00:00Z
    Avaya Aura Application Enablement Services weak permissions in web application
    cvelistv5