What is CVE-2019-7003?

CVE-2019-7003 is a critical-severity vulnerability in Avaya Control Manager, classified under SQL Injection. CVSS score: 10.0/10. Published 2019-07-11.

How severe is CVE-2019-7003?

Critical severity. CVSS v3 base score is 10.0 out of 10.

SQL Injection in Avaya Control Manager

CVE-2019-7003

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

Vulnerability class: SQL Injection

EPSS: 0.015 (70.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

Affected products

Avaya Control Manager — versions 8.0.x prior to 8.0.4.0, 7.x
Avaya Control_manager

Weakness classification (CWE)

CWE-89 — SQL Injection

References

securityalerts@avaya.com (x_refsource_CONFIRM, Vendor Advisory)
securityalerts@avaya.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
nvd@nist.gov (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2019-7003?: CVE-2019-7003 is a critical-severity vulnerability in Avaya Control Manager, classified under SQL Injection. CVSS score: 10.0/10. Published 2019-07-11.
How severe is CVE-2019-7003?: Critical severity. CVSS v3 base score is 10.0 out of 10.