« Volver al listado

CVE-2018-15616

Estado: ModificadaCrítica (9.8)—

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Avaya — Avaya Aura System Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-15616",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "securityalerts@avaya.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "securityalerts@avaya.com",
      "affectedData": [
        {
          "vendor": "Avaya",
          "product": "Avaya Aura® System Platform",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.x",
              "versionType": "custom",
              "lessThanOrEqual": "6.3.9"
            },
            {
              "status": "affected",
              "version": "6.4.x",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-17T18:29:01.083",
  "references": [
    {
      "url": "https://downloads.avaya.com/css/P8/documents/101052865",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "securityalerts@avaya.com"
    },
    {
      "url": "https://downloads.avaya.com/css/P8/documents/101052865",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "securityalerts@avaya.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el componente Web UI de Avaya Aura System Platform podría permitir que un usuario remoto no autenticado realice un ataque de deserialización dirigida que podría resultar en la ejecución remota de código. Las versiones afectadas de System Platform incluyen de la versión 6.3.0 a la 6.3.9 y desde la versión 6.4.0 hasta la 6.4.2."
    }
  ],
  "lastModified": "2026-06-17T01:42:50.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:avaya:avaya_aura_system_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E14F2397-C0C9-4604-86A3-0366422C100E",
              "versionEndIncluding": "6.3.9",
              "versionStartIncluding": "6.3.0"
            },
            {
              "criteria": "cpe:2.3:h:avaya:avaya_aura_system_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B23E0CE3-915A-4194-A10B-E9DEDAECAFAC",
              "versionEndIncluding": "6.4.2",
              "versionStartIncluding": "6.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "securityalerts@avaya.com"
}