Unscored severity · published Jul 9, 2008
CVE-2008-3081
Multiple unspecified "input validation" vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0,…
–
CVSS
3.1%
EPSS
No
On KEV
Description
Multiple unspecified "input validation" vulnerabilities in the Web management interface (aka Messaging Administration interface) in Avaya Message Storage Server (MSS) 3.x and 4.0, and possibly Communication Manager 3.1.x, allow remote authenticated administrators to execute arbitrary commands as user vexvm via vectors related to (1) SFTP Remote Store configuration; (2) remote FTP storage settings; (3) name server lookup; (4) pinging another host; (5) TCP/IP Networking parameter configuration; (6) the external hosts configuration main page; (7) adding and changing external hosts; (8) Windows domain parameter configuration; (9) date, time, and NTP server configuration; (10) alarm settings; (11) the command line history form; (12) the maintenance form; and (13) the server events form.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Messaging Storage Server · Avaya
3; 3.1; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3081
osvdb.org
http://osvdb.org/46587
Vendor Advisory
http://secunia.com/advisories/30777
support.avaya.com
http://support.avaya.com/elmodocs2/security/ASA-2008-269.htm
www.securityfocus.com
http://www.securityfocus.com/bid/29938
www.voipshield.com
http://www.voipshield.com/research-details.php?id=100
www.voipshield.com
http://www.voipshield.com/research-details.php?id=101
More from Messaging Storage Server
7.8
CVE-2009-0115
The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly…
7.8
CVE-2008-2812
The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via…
5.5
CVE-2006-1058
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow…
5.5
CVE-2001-1494
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system,…
–
CVE-2007-5830
Unspecified vulnerability in the administrative interface in Avaya Messaging Storage Server (MSS) 3.1 before SP1, and Message Networking (MN) 3.1, allows remote attackers to cause…