What is CVE-2018-15616?

CVE-2018-15616 is a critical-severity vulnerability in Avaya Aura® System Platform, classified under Deserialization of Untrusted Data. CVSS score: 9.0/10. Published 2018-10-17.

How severe is CVE-2018-15616?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Deserialization in Avaya Aura® System Platform

CVE-2018-15616

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.

Vulnerability class: Insecure Deserialization

EPSS: 0.033 (87.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Avaya Aura® System Platform — versions 6.3.x, 6.4.x
Avaya Avaya_aura_system_platform

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

securityalerts@avaya.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2018-15616?: CVE-2018-15616 is a critical-severity vulnerability in Avaya Aura® System Platform, classified under Deserialization of Untrusted Data. CVSS score: 9.0/10. Published 2018-10-17.
How severe is CVE-2018-15616?: Critical severity. CVSS v3 base score is 9.0 out of 10.