Unscored severity · published Apr 1, 2009
CVE-2008-6573
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Communication Manager · Avaya
through 3.1; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.4; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6573
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6573
osvdb.org
http://osvdb.org/44284
osvdb.org
http://osvdb.org/44285
osvdb.org
http://osvdb.org/44286
Vendor Advisory
http://secunia.com/advisories/29744
support.avaya.com
http://support.avaya.com/elmodocs2/security/ASA-2008-150.htm
Vendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2008-151.htm
More from Communication Manager
7.8
CVE-2008-2812
The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via…
7.5
CVE-2018-15617
Communication Manager Denial of Service
–
CVE-2008-6711
Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated users…
–
CVE-2008-6710
Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0.3 SP1 allows remote authenticated…
–
CVE-2008-6709
Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, allows remote…