CVE-2018-15612 Orchestration Designer Runtime Config CSRF
Attackers can modify administrative settings in Avaya Aura Orchestration Designer via CSRF, potentially escalating privileges or altering configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-15612?
CVE-2018-15612 is a high-severity vulnerability in Avaya Orchestration Designer, published on 21 Sep 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
Weakness: CWE-352
Which versions are affected by CVE-2018-15612?
It affects 1 product.
Products include Avaya Orchestration Designer.
How do I fix CVE-2018-15612?
No fix has been published for CVE-2018-15612 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15612 being exploited?
There is no known exploitation of CVE-2018-15612 in the wild and no public exploit code.
Sources
Also known as GHSA-qcf9-f8qc-c69h.