CVE-2020-7030 - IPO Information Disclosure

Back Back to CVE browser

MEDIUM

IPO Information Disclosure

Published Jun 3, 2020

5.5

MEDIUM

CVSS 3.1

EPSS 1.04%

Description

A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.

Affected products

Vendor Avaya Product IP Office Default
n/a
- Version
  10.0
  Status
  affected
  Constraints
  <10.1.0.8
- Version
  11.0
  Status
  affected
  Constraints
  <11.0.4.3
- Version
  9.x
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Avaya

IP Office

n/a

Version	Status	Constraints
10.0	affected	<10.1.0.8
11.0	affected	<11.0.4.3
9.x	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-522

Insufficiently Protected Credentials

References (4)

http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html
x_refsource_MISC
http://seclists.org/fulldisclosure/2020/Jun/12
mailing-listx_refsource_FULLDISC
https://downloads.avaya.com/css/P8/documents/101067493
x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28164
Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/157957/Avaya-IP-Office-11-Insecure-Transit-Password-Disclosure.html		x_refsource_MISC
http://seclists.org/fulldisclosure/2020/Jun/12		mailing-listx_refsource_FULLDISC
https://downloads.avaya.com/css/P8/documents/101067493		x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28164		Advisory