High severity · published Feb 5, 2018
CVE-2018-6635
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Aura · Avaya
through 7.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6635
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6635
Third Party Advisory
http://www.securityfocus.com/bid/102940
Third Party Advisory
http://www.securitytracker.com/id/1040329
Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101038598