CVE-2018-15610
Estado: ModificadaAlta (8.8)—
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.85%
- Percentil entre todas las CVEs puntuadas: 78
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-284
- CWE-22
Referencias
- https://downloads.avaya.com/css/P8/documents/101051984
- https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html
- https://downloads.avaya.com/css/P8/documents/101051984
- https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-15610",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "securityalerts@avaya.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.2,
"exploitabilityScore": 2.1
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "securityalerts@avaya.com",
"affectedData": [
{
"vendor": "Avaya",
"product": "IP Office",
"versions": [
{
"status": "affected",
"version": "9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2"
}
]
}
]
}
],
"published": "2018-09-12T21:29:00.330",
"references": [
{
"url": "https://downloads.avaya.com/css/P8/documents/101051984",
"tags": [
"Vendor Advisory"
],
"source": "securityalerts@avaya.com"
},
{
"url": "https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html",
"source": "securityalerts@avaya.com"
},
{
"url": "https://downloads.avaya.com/css/P8/documents/101051984",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-File-Disclosure-Deletion.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "securityalerts@avaya.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el componente one-X Portal de Avaya IP Office permite que un atacante autenticado lea y elimine archivos arbitrarios en el sistema. Las versiones afectadas de Avaya IP Office incluyen desde la 9.1 hasta la 9.1 SP12, desde la 10.0 hasta la 10.0 SP7 y desde la 10.1 hasta la 10.1 SP2."
}
],
"lastModified": "2026-06-17T01:42:50.207",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62D4B983-0DD2-4DB8-A085-4AEEC2BDFC8C"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9468982C-DB32-490B-9131-9D35E8339467"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B490A4A-A837-4CC6-8A44-5A7F03D73619"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C4A09C00-8D54-4674-A1D9-2F5AAD44CDD6"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "67BFAB48-462F-4E95-9619-7A54E4BDF6F1"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7284D50-F3D2-4B7B-9147-346100611D46"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E488E9F3-5329-43F1-AC9D-36760B95C91A"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CDD19739-0237-4C6F-9B6C-E47C9053F82A"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACC5B2C8-CA4E-4482-8842-52886C5D5397"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "09060F4E-DDB3-4C45-B628-6357ED0FA008"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C6013D3-4D4C-46F8-82E6-271FB44FD126"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1BED830-57D9-4051-B9D0-4E010AFA7451"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:9.1:sp9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "110B4593-6CF2-443B-AC7D-7DA98C44058C"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "96AC8E27-36AF-4063-9816-9B32FA8495AA"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B86F3D17-7408-4721-9921-3EB702018C6F"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BA3D7B64-7AD6-47D0-846D-A70C2838B653"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0EF71DB4-1523-4270-B0D8-0D20A2A6EAE8"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E32E623-597A-4931-B7CF-EED6EEBA61DF"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47898FEC-4BB7-469F-9020-2D9FB1B2C50E"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D429B865-B22A-4F9B-922F-D1F817DF1147"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.0:sp7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE40493E-ED60-4BFC-9E48-D3148E4D0834"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "71D9AA27-CBFC-4547-A1D0-777D9C11EE13"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.1:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40E9E848-9578-41C5-AD68-1F1EF954CCCF"
},
{
"criteria": "cpe:2.3:a:avaya:ip_office:10.1:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D4712EC5-6085-46C3-949C-12E815099D52"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "securityalerts@avaya.com"
}