CVE-2018-15615 CMS Supervisor Information Disclosure
Local administrative users can extract sensitive information from remote CMS Supervisor connections, requiring vendor patches.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-15615?
CVE-2018-15615 is a high-severity vulnerability in Avaya Call Management System Supervisor, published on 24 Sep 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connecting to a remote CMS host. Affected versions of CMS Supervisor include R17.0.x and R18.0.x.
Weakness: CWE-200
Which versions are affected by CVE-2018-15615?
It affects 1 product.
Products include Avaya Call Management System Supervisor.
How do I fix CVE-2018-15615?
No fix has been published for CVE-2018-15615 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-15615 being exploited?
There is no known exploitation of CVE-2018-15615 in the wild and no public exploit code.
Sources
Also known as GHSA-r9wc-jf2x-pw9x.