CVE-2024-7477

CWE-89 — SQL Injection3 documents3 sources
Severity
6.7MEDIUM
EPSS
0.1%
top 65.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Avaya Aura System Manager
Timeline
PublishedAug 8

Description

A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HExploitability: 0.6 | Impact: 5.9

Affected Packages2 packages

▶NVDavaya/aura_system_manager10.1 — 10.1.2+1
▶CVEListV5avaya/aura_system_manager10.1.x.x, 10.2.x.x+1

🔴Vulnerability Details

2
GHSA
GHSA-898x-8mpw-mjf8: A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary quer↗2024-08-08
▶
CVEList
Avaya Aura System Manager SQL injection vulnerability↗2024-08-08
▶
CVE-2024-7477 (MEDIUM CVSS 6.7) | A SQL injection vulnerability was f | cvebase.io