CVE-2022-2975

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://download.avaya.com/css/public/documents/101083688	Vendor Advisory
https://download.avaya.com/css/public/documents/101083688	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:avaya:aura_application_enablement_services::::::::
	cpe:2.3:a:avaya:aura_application_enablement_services::::::::

History

21 Nov 2024, 07:02

Type	Values Removed	Values Added
References	~~() https://download.avaya.com/css/public/documents/101083688 - Vendor Advisory~~	() https://download.avaya.com/css/public/documents/101083688 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~6.7~~	v2 : unknown v3 : 7.7

Information

Published : 2022-10-06 18:15

Updated : 2024-11-21 07:02

NVD link : CVE-2022-2975

Mitre link : CVE-2022-2975

CVE.ORG link : CVE-2022-2975

JSON object : View

Products Affected

avaya

aura_application_enablement_services

CWE

CWE-269

Improper Privilege Management

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2022-2975", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "securityalerts@avaya.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2022-10-06T18:15:59.447", "references": [{"url": "https://download.avaya.com/css/public/documents/101083688", "tags": ["Vendor Advisory"], "source": "securityalerts@avaya.com"}, {"url": "https://download.avaya.com/css/public/documents/101083688", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "securityalerts@avaya.com", "description": [{"lang": "en", "value": "CWE-269"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad relacionada con permisos d\u00e9biles en la aplicaci\u00f3n web de Avaya Aura Application Enablement Services, que permit\u00eda que un usuario administrativo modificara las cuentas, conllevando a una ejecuci\u00f3n de c\u00f3digo arbitrario como usuario root. Este problema afecta a versiones 8.0.0.0 a 8.1.3.4 y 10.1.0.0 a 10.1.0.1 de Application Enablement Services. Las versiones anteriores a 8.0.0.0 han finalizado el soporte de fabricaci\u00f3n y no han sido evaluadas"}], "lastModified": "2024-11-21T07:02:00.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avaya:aura_application_enablement_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD81EA29-F119-4C77-85EB-6C41A7169BA0", "versionEndExcluding": "8.1.3.5", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:a:avaya:aura_application_enablement_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D0290D1-DAFA-43B9-A92D-BAACE6A68ACC", "versionEndExcluding": "10.1.0.2", "versionStartIncluding": "10.1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "securityalerts@avaya.com"}