CVE-2018-15610 Improper access controls in IP Office one-X Portal
Authenticated attackers can read and delete arbitrary files in Avaya IP Office one-X Portal due to improper access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-15610?
CVE-2018-15610 is a high-severity path traversal vulnerability in Avaya IP Office, published on 12 Sep 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2.
Which versions are affected by CVE-2018-15610?
It affects 1 product.
Products include Avaya Ip Office.
How do I fix CVE-2018-15610?
No fix has been published for CVE-2018-15610 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-15610 being exploited?
There is no known exploitation of CVE-2018-15610 in the wild and no public exploit code.
Other vulnerabilities in Avaya IP Office
Sources
Also known as CVE-2018-8812, GHSA-j59g-53xm-7h2j.