169 lines
6.7 KiB
JSON
169 lines
6.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-7477",
|
||
"assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "avaya",
|
||
"dateReserved": "2024-08-05T07:37:13.538Z",
|
||
"datePublished": "2024-08-08T16:02:43.125Z",
|
||
"dateUpdated": "2024-08-09T18:21:58.052Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Aura System Manager",
|
||
"vendor": "Avaya",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "10.1.x.x"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "10.2.x.x"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "A SQL injection vulnerability was found which could allow a command line interface (CLI) user with <span style=\"background-color: rgb(255, 255, 255);\">administrative privileges to execute arbitrary queries against the <span style=\"background-color: rgb(255, 255, 255);\">Avaya Aura System Manager </span>database. \n\nAffected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support.\n\n</span> "
|
||
}
|
||
],
|
||
"value": "A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary queries against the Avaya Aura System Manager database. \n\nAffected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-66",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-66 SQL Injection"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 6.5,
|
||
"baseSeverity": "MEDIUM",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "HIGH",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-89",
|
||
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "9d670455-bdb5-4cca-a883-5914865f5d96",
|
||
"shortName": "avaya",
|
||
"dateUpdated": "2024-08-08T16:02:43.125Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "https://download.avaya.com/css/public/documents/101091159"
|
||
}
|
||
],
|
||
"source": {
|
||
"defect": [
|
||
"ZEPHYR-70310"
|
||
],
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "Avaya Aura System Manager SQL injection vulnerability",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.1.0-dev"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"affected": [
|
||
{
|
||
"vendor": "avaya",
|
||
"product": "aura_system_manager",
|
||
"cpes": [
|
||
"cpe:2.3:a:avaya:aura_system_manager:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"versions": [
|
||
{
|
||
"version": "10.1.x.x",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "10.2.x.x",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-08-09T18:20:16.174969Z",
|
||
"id": "CVE-2024-7477",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-08-09T18:21:58.052Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |