« Volver al listado

CVE-2022-2975

Estado: ModificadaMedia (6.7)—

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Avaya — Aura Application Enablement Services

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2975",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "securityalerts@avaya.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "securityalerts@avaya.com",
      "affectedData": [
        {
          "vendor": "Avaya",
          "product": "Avaya Aura Application Enablement Services",
          "versions": [
            {
              "status": "affected",
              "version": "10.1.x",
              "versionType": "custom",
              "lessThanOrEqual": "10.1.0.1"
            },
            {
              "status": "affected",
              "version": "8.x",
              "versionType": "custom",
              "lessThanOrEqual": "8.1.3.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-06T18:15:59.447",
  "references": [
    {
      "url": "https://download.avaya.com/css/public/documents/101083688",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "securityalerts@avaya.com"
    },
    {
      "url": "https://download.avaya.com/css/public/documents/101083688",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "securityalerts@avaya.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated."
    },
    {
      "lang": "es",
      "value": "Se detectó una vulnerabilidad relacionada con permisos débiles en la aplicación web de Avaya Aura Application Enablement Services, que permitía que un usuario administrativo modificara las cuentas, conllevando a una ejecución de código arbitrario como usuario root. Este problema afecta a versiones 8.0.0.0 a 8.1.3.4 y 10.1.0.0 a 10.1.0.1 de Application Enablement Services. Las versiones anteriores a 8.0.0.0 han finalizado el soporte de fabricación y no han sido evaluadas"
    }
  ],
  "lastModified": "2026-06-17T04:42:54.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avaya:aura_application_enablement_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD81EA29-F119-4C77-85EB-6C41A7169BA0",
              "versionEndExcluding": "8.1.3.5",
              "versionStartIncluding": "8.0.0.0"
            },
            {
              "criteria": "cpe:2.3:a:avaya:aura_application_enablement_services:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D0290D1-DAFA-43B9-A92D-BAACE6A68ACC",
              "versionEndExcluding": "10.1.0.2",
              "versionStartIncluding": "10.1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "securityalerts@avaya.com"
}