CVE-2022-2249 Avaya Aura Communication Manager Privilege Escalation Vulnerabilities

What is CVE-2022-2249?

CVE-2022-2249 is a high-severity vulnerability in Avaya Aura Communication Manager, published on 12 Oct 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.

Weakness: CWE-269

Which versions are affected by CVE-2022-2249?

It affects 1 product.

Products include Avaya Aura Communication Manager.

How do I fix CVE-2022-2249?

No fix has been published for CVE-2022-2249 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-2249 being exploited?

There is no known exploitation of CVE-2022-2249 in the wild and no public exploit code.

Other vulnerabilities in Avaya Aura Communication Manager

• CVE-2010-2943 Information disclosure in n/a High 8.1
• CVE-2010-2492 Memory corruption in n/a High 7.8
• CVE-2010-2798 Null dereference in n/a High 7.8
• CVE-2018-15617 Communication Manager Denial of Service Medium 6.5
• CVE-2020-7029 Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ggr7-6fj3-6vpv.