What is CVE-2018-15610?

CVE-2018-15610 is a high-severity vulnerability in Avaya Ip Office, classified under Improper Access Control. CVSS score: 7.3/10. Published 2018-09-12.

How severe is CVE-2018-15610?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2018-15610 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Avaya Ip Office

CVE-2018-15610

A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, a…

EPSS: 0.006 (69.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H.

Affected products

Avaya Ip Office — versions 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2

Weakness classification (CWE)

CWE-284 — Improper Access Control

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

downloads.avaya.com/css/P8/documents/101051984 (x_refsource_CONFIRM)
packetstormsecurity.com/files/149284/Avaya-one-X-9.x-10.0.x-10.1.x-Arbitrary-Fi… (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-15610?: CVE-2018-15610 is a high-severity vulnerability in Avaya Ip Office, classified under Improper Access Control. CVSS score: 7.3/10. Published 2018-09-12.
How severe is CVE-2018-15610?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2018-15610 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.