High severity · published Apr 4, 2019
CVE-2019-7001
A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users…
8.8
CVSS
1.2%
EPSS
No
On KEV
Description
A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and 10.x versions prior to 10.1.2.2.2-11201.1908. Unsupported versions not listed here were not evaluated.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IO
IP Office Contact Center · Avaya
9.0.0 through 9.1.9; 10.0.0.0 through 10.1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7001
Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101056762
More from IP Office Contact Center
8.8
CVE-2017-12969
Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1.1 allows remote attackers to cause a denial of service (heap…