CVE-2022-2975
High
Description
A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.
SeverityHigh
CVSS7.7
Exploit probability—
ProductAvaya Aura Application Enablement Services
PublishedOct 6, 2022
First seenOct 6, 2022
Weakness typeCWE-269Improper privilege management
How to fix
Update
- avaya aura_application_enablement_services8.1.3.5, 10.1.0.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya aura_application_enablement_services | 8.0.0.0 ≤ v < 8.1.3.5, 10.1.0.0 ≤ v < 10.1.0.2 | 8.1.3.5, 10.1.0.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.