What is CVE-2018-6635?

CVE-2018-6635 is a high-severity vulnerability in Avaya Aura, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2018-02-05.

How severe is CVE-2018-6635?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Avaya Aura

CVE-2018-6635

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.

EPSS: 0.012 (64.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Avaya Aura
N/a — versions n/a

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2018-6635?: CVE-2018-6635 is a high-severity vulnerability in Avaya Aura, classified under Inadequate Encryption Strength. CVSS score: 7.5/10. Published 2018-02-05.
How severe is CVE-2018-6635?: High severity. CVSS v3 base score is 7.5 out of 10.