CVE-2020-7029 Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability

What is CVE-2020-7029?

CVE-2020-7029 is a medium-severity vulnerability in Avaya Aura Communication Manager, published on 11 Aug 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.

Weakness: CWE-352

Which versions are affected by CVE-2020-7029?

It affects 2 products.

Products include Avaya Aura Communication Manager, Avaya Aura Messaging.

How do I fix CVE-2020-7029?

No fix has been published for CVE-2020-7029 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-7029 being exploited?

There is no known exploitation of CVE-2020-7029 in the wild and no public exploit code.

Other vulnerabilities in Avaya Aura Communication Manager

• CVE-2010-2943 Information disclosure in n/a High 8.1
• CVE-2010-2492 Memory corruption in n/a High 7.8
• CVE-2010-2798 Null dereference in n/a High 7.8
• CVE-2022-2249 Avaya Aura Communication Manager Privilege Escalation Vulnerabilities High 7.7
• CVE-2018-15617 Communication Manager Denial of Service Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5q3j-92g6-wmx8.