Critical severity · published Jul 11, 2019
CVE-2019-7003
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive…
10.0
CVSS
1.5%
EPSS
No
On KEV
Description
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Control Manager · Avaya
7.0 before 8.0.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-7003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-7003
Broken Link
http://www.securityfocus.com/bid/109134
Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101059368
Release Notes
https://support.avaya.com/documents/documents-by-contenttype.action?product_id=P0941&product_name=Control+Manager&release_number=releaseId&contentType=ReleaseNotes