CVE-2019-7003

published 2019-07-11

CVE-2019-7003: A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and…

Priority P2 71 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A N

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
avaya	avaya_control_manager	—	—
avaya	avaya_control_manager	—	—
avaya	control_manager	>= 7.0 < 8.0.4.0	8.0.4.0

CVSS provenance

nvd v3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

nvd v3.0 9.3 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

nvd v2.0 6.4 MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89