Medium severity · published Jun 24, 2021
CVE-2021-25649
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services
5.5
CVSS
0.6%
EPSS
No
On KEV
Description
An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility Services
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
Aura Utility Services · Avaya
7.0 through 7.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25649
Vendor Advisory
https://support.avaya.com/css/P8/documents/101072728
More from Aura Utility Services
8.8
CVE-2021-25650
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specially crafted scripts as a privileged…
7.8
CVE-2021-25651
A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to escalate privileges
7.5
CVE-2016-5285
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which…