CVE-2023-3722CWE-434

Avaya Aura Device Services Remote Code Execution

High · published July 19, 2023

CVSS v3.1
8.6
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.03860 · 90.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-07-19T19:56Z
EPSS history
Timeline
  • 19 JUL 19:56Z
    Avaya Aura Device Services Remote Code Execution
    cvelistv5