« Volver al listado

CVE-2020-7029

Estado: ModificadaAlta (8.8)—

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Avaya — Aura Communication ManagerAvaya — Aura Messaging

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7029",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "securityalerts@avaya.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "securityalerts@avaya.com",
      "affectedData": [
        {
          "vendor": "Avaya",
          "product": "Avaya Aura Communication Manager",
          "versions": [
            {
              "status": "affected",
              "version": "8.0.x"
            },
            {
              "status": "affected",
              "version": "7.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.1.3.4"
            }
          ]
        },
        {
          "vendor": "Avaya",
          "product": "Avaya Aura Messaging",
          "versions": [
            {
              "status": "affected",
              "version": "7.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.1 SP1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-11T23:15:11.590",
  "references": [
    {
      "url": "https://support.avaya.com/css/P8/documents/101070201",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "securityalerts@avaya.com"
    },
    {
      "url": "https://support.avaya.com/css/P8/documents/101070201",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "securityalerts@avaya.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1."
    },
    {
      "lang": "es",
      "value": "Se descubrió una vulnerabilidad de Cross-Site Request Forgery (CSRF) en el componente System Management Interface Web de  Avaya Aura Communication Manager y Avaya Aura Messaging. Esta vulnerabilidad podría permitir a un atacante remoto no autenticado realizar acciones de administración Web con el nivel privilegiado del usuario autenticado. Las versiones afectadas del Communication Manager son 7.0.x, 7.1.x anteriores a 7.1.3.5 y 8.0.x. Las versiones afectadas de Messaging son 7.0.x, 7.1 y 7.1 SP1"
    }
  ],
  "lastModified": "2026-06-17T03:24:08.300",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avaya:aura_communication_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B2D1D2F-EDE8-40B0-AE63-715D53EAC2B9",
              "versionEndIncluding": "7.1.3.4",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:avaya:aura_communication_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "679841D8-6125-4FED-9122-C2D337F354AA",
              "versionEndExcluding": "8.1.0.0",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:avaya:aura_messaging:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "425188C6-4F93-40F7-9D78-5937FC182A4B",
              "versionEndExcluding": "7.1",
              "versionStartIncluding": "7.0"
            },
            {
              "criteria": "cpe:2.3:a:avaya:aura_messaging:7.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE2234D7-2F36-40C0-97AD-E9C8B48A848D"
            },
            {
              "criteria": "cpe:2.3:a:avaya:aura_messaging:7.1:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71239989-8729-4434-8AB2-1AE983A80C49"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "securityalerts@avaya.com"
}