What is CVE-2023-3527?

CVE-2023-3527 is a medium-severity vulnerability in Avaya Call Management System, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 6.8/10. Published 2023-07-18.

How severe is CVE-2023-3527?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Vulnerability in Avaya Call Management System

CVE-2023-3527

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary…

EPSS: 0.005 (41.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L.

Affected products

Avaya Call Management System — versions 19.x.x.x
Avaya Call_management_system

Weakness classification (CWE)

CWE-1236 — Improper Neutralization of Formula Elements in a CSV File

References

securityalerts@avaya.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2023-3527?: CVE-2023-3527 is a medium-severity vulnerability in Avaya Call Management System, classified under Improper Neutralization of Formula Elements in a CSV File. CVSS score: 6.8/10. Published 2023-07-18.
How severe is CVE-2023-3527?: Medium severity. CVSS v3 base score is 6.8 out of 10.