by Kastro
Paper/Archive/CVE-2023-3722

CVE-2023-3722

Avaya Aura Device Services — Avaya Aura Device Services Remote Code Execution

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.2.902 × 2018.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Affected

ProductAffectedFixed inSource
Aura Device Services< 8.1.4.18.1.4.1CNA
aura_device_services< 8.1.4.18.1.4.1CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
avaya (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdownload.avaya.com/css/public/documents/101076366