What is CVE-2019-7001?

CVE-2019-7001 is a critical-severity vulnerability in Avaya Ip Office Contact Center, classified under SQL Injection. CVSS score: 9.9/10. Published 2019-04-04.

How severe is CVE-2019-7001?

Critical severity. CVSS v3 base score is 9.9 out of 10.

SQL Injection in Avaya Ip Office Contact Center

CVE-2019-7001

A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and 10.x versions prior to 10.1.2.2.2-11201.1908. Unsupported versions not listed here were not evaluated.

Vulnerability class: SQL Injection

EPSS: 0.012 (64.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Avaya Ip Office Contact Center — versions 10.0.x 10.x, 9.x, 10.1.x
Avaya Ip_office_contact_center

Weakness classification (CWE)

CWE-89 — SQL Injection

References

securityalerts@avaya.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2019-7001?: CVE-2019-7001 is a critical-severity vulnerability in Avaya Ip Office Contact Center, classified under SQL Injection. CVSS score: 9.9/10. Published 2019-04-04.
How severe is CVE-2019-7001?: Critical severity. CVSS v3 base score is 9.9 out of 10.