« Volver al listado

CVE-2018-15615

Estado: ModificadaMedia (4.4)—

A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Avaya — Call Management System Supervisor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15615",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "securityalerts@avaya.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 7.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 0.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "securityalerts@avaya.com",
      "affectedData": [
        {
          "vendor": "Avaya",
          "product": "Call Management System Supervisor",
          "versions": [
            {
              "status": "affected",
              "version": "Affected verisons include R17.0.x and R18.0.x"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-09-24T12:29:00.237",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105392",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "securityalerts@avaya.com"
    },
    {
      "url": "https://downloads.avaya.com/css/P8/documents/101052300",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "securityalerts@avaya.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105392",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://downloads.avaya.com/css/P8/documents/101052300",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "securityalerts@avaya.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el componente Supervisor de Avaya Call Management System permite que un usuario local administrador extraiga información sensible de usuarios que se conectan a un host CMS remoto. Las versiones afectadas de CMS Supervisor incluyen la R17.0.x y la R18.0.x."
    }
  ],
  "lastModified": "2026-06-17T01:42:50.837",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avaya:call_management_system_supervisor:17.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EBA9AE0-BB26-4A4A-975C-F6D7A23B3301"
            },
            {
              "criteria": "cpe:2.3:a:avaya:call_management_system_supervisor:18.0.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1D82CD8-A47D-44D7-A744-723652A27135"
            },
            {
              "criteria": "cpe:2.3:a:avaya:call_management_system_supervisor:18.0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8EE901F-5E3B-40AA-9DC5-8D53D255FCE7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "securityalerts@avaya.com"
}