CRITICAL🇵🇱 Wersja polska

CVE-2019-7003

CVSS 10.0v3.1pub. 2019-07-11upd. 2024-11-21

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

  • Avaya Control Manager

    APP
    Avaya
    7.0 – 8.0.4.0 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLiAuth Bypass
CWE
References

Related vulnerabilities

CVE-2025-1041CRITICAL9.9PL ✓ten sam vendor

Zdalne wykonanie poleceń w Avaya Call Management System (CWE-20)

CVE-2024-4197CRITICAL9.9PL ✓ten sam vendor

Unrestricted file upload umożliwiający RCE w Avaya IP Office (One-X)

CVE-2024-4196CRITICAL10.0PL ✓ten sam vendor

RCE poprzez improper input validation w Avaya IP Office (Web Control)

CVE-2022-38168CRITICAL9.1ten sam vendor

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows...

CVE-2019-7001CRITICAL9.9ten sam vendor

A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated ...