SQL Injection in Avaya Control Manager
CVE-2019-7003
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Avaya Control Manager — versions 8.0.x prior to 8.0.4.0, 7.x
- Avaya Control Manager
Weakness classification (CWE)
References
- downloads.avaya.com/css/P8/documents/101059368 (Vendor Advisory)
- www.securityfocus.com/bid/109134 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)
- support.avaya.com/documents/documents-by-contenttype.action (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-7003?
- CVE-2019-7003 is a critical-severity vulnerability in Avaya Control Manager, classified under SQL Injection. CVSS score: 10.0/10. Published 2019-07-11.
- How severe is CVE-2019-7003?
- Critical severity. CVSS v3 base score is 10.0 out of 10.