CVE-2018-15614: A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the…

PriorityP425medium5.4CVSS 3.0

AVNACLPRLUIRSCCLILAN

EPSS

0.62%

45.3th percentile

A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
avaya	ip_office	—	—
avaya	ip_office	—	—
avaya	ip_office	—	—
avaya	ip_office	>= 10.x < 10.1 SP4	10.1 SP4
avaya	ip_office	>= 11.x < 11.0 SP1	11.0 SP1

CVSS provenance

nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.