Medium severity · published Oct 6, 2022
CVE-2022-2975
Avaya Aura Application Enablement Services weak permissions in web application
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Avaya Aura Application Enablement Services · Avaya
10.1.x through 10.1.0.1; 8.x through 8.1.3.4 · source: vendor
AA
Aura Application Enablement Services · Avaya
8.0.0.0 before 8.1.3.5; 10.1.0.0 before 10.1.0.2 · source: NVD
Affected product
AA
Avaya Aura Application Enablement Services
Avaya