CVE-2018-15614

Published: Jan 23, 2019Modified: Nov 21, 2024

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.

Affected (13)

Products: Avaya: Ip Office

Avaya

1 product

Ip Office

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Avaya Ip Office	Version 10.0
Avaya Ip Office	Version 10.0 sp1
Avaya Ip Office	Version 10.0 sp2
Avaya Ip Office	Version 10.0 sp3
Avaya Ip Office	Version 10.0 sp4
Avaya Ip Office	Version 10.0 sp5
Avaya Ip Office	Version 10.0 sp6
Avaya Ip Office	Version 10.0 sp7
Avaya Ip Office	Version 10.1
Avaya Ip Office	Version 10.1 sp1
Avaya Ip Office	Version 10.1 sp2
Avaya Ip Office	Version 10.1 sp3
Avaya Ip Office	Version 11.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://downloads.avaya.com/css/P8/documents/101054317

Source: securityalerts@avaya.com

Vendor Advisory

https://downloads.avaya.com/css/P8/documents/101054317

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.