CRITICAL🇵🇱 Wersja polska

CVE-2019-7001

CVSS 9.9v3.0pub. 2019-04-04upd. 2024-11-21

A SQL injection vulnerability in the WebUI component of IP Office Contact Center could allow an authenticated attacker to retrieve or alter sensitive data related to other users on the system. Affected versions of IP Office Contact Center include all 9.x and 10.x versions prior to 10.1.2.2.2-11201.1908. Unsupported versions not listed here were not evaluated.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Avaya Ip Office Contact Center

    APP
    Avaya
    9.0.0 – 9.1.910.0.0.0 – 10.1.2.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2017-12969HIGH8.8same product

Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before 10.1....

CVE-2025-1041CRITICAL9.9PL ✓same vendor

Zdalne wykonanie poleceń w Avaya Call Management System (CWE-20)

CVE-2024-4197CRITICAL9.9PL ✓same vendor

Unrestricted file upload umożliwiający RCE w Avaya IP Office (One-X)

CVE-2024-4196CRITICAL10.0PL ✓same vendor

RCE poprzez improper input validation w Avaya IP Office (Web Control)

CVE-2022-38168CRITICAL9.1PL ✓same vendor

Pominięcie uwierzytelnienia w Avaya Scopia Pathfinder 10/20 PTS via modyfikacja URL