CVE-2020-7029

CWE-352 — Cross-Site Request Forgery (CSRF)3 documents3 sources
Severity
8.8HIGH
EPSS
0.2%
top 54.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Avaya Aura Communication ManagerAvaya Aura MessagingAvaya Avaya Aura Communication Manager+1 more
Timeline
PublishedAug 11
Latest updateMay 24

Description

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:LExploitability: 1.6 | Impact: 4.7

Affected Packages4 packages

▶NVDavaya/aura_communication_manager8.0 — 8.1.0.0+1
▶CVEListV5avaya/avaya_aura_communication_manager7.0 — 7.1.3.4+1
▶NVDavaya/aura_messaging7.0 — 7.1+1
▶CVEListV5avaya/avaya_aura_messaging7.0 — 7.1 SP1

🔴Vulnerability Details

2
GHSA
GHSA-5q3j-92g6-wmx8: A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager↗2022-05-24
▶
CVEList
Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability↗2020-08-11
▶