CVE-2022-2975 Avaya Aura Application Enablement Services weak permissions in web application
Administrative users can exploit weak permissions to modify accounts and execute arbitrary code as root in Avaya Aura Application Enablement Services.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-2975?
CVE-2022-2975 is a high-severity vulnerability in Avaya Aura Application Enablement Services, published on 6 Oct 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.
Which versions are affected by CVE-2022-2975?
It affects 1 product.
Products include Avaya Aura Application Enablement Services.
How do I fix CVE-2022-2975?
No fix has been published for CVE-2022-2975 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-2975 being exploited?
There is no known exploitation of CVE-2022-2975 in the wild and no public exploit code.
Other vulnerabilities in Avaya Aura Application Enablement Services
Sources
Also known as GHSA-r43q-fm6x-4jgq.