CVE-2018-15616

{"containers": {"cna": {"affected": [{"product": "Avaya Aura\u00ae System Platform", "vendor": "Avaya", "versions": [{"lessThanOrEqual": "6.3.9", "status": "affected", "version": "6.3.x", "versionType": "custom"}, {"lessThanOrEqual": "6.4.2", "status": "affected", "version": "6.4.x", "versionType": "custom"}]}], "datePublic": "2018-10-17T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T18:57:01.000Z", "orgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "shortName": "avaya"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://downloads.avaya.com/css/P8/documents/101052865"}], "source": {"advisory": "ASA-2018-296"}, "title": "System Platform Web UI Deserialization", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "securityalerts@avaya.com", "ID": "CVE-2018-15616", "STATE": "PUBLIC", "TITLE": "System Platform Web UI Deserialization"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Avaya Aura\u00ae System Platform", "version": {"version_data": [{"affected": "<=", "version_affected": "<=", "version_name": "6.3.x", "version_value": "6.3.9"}, {"affected": "<=", "version_affected": "<=", "version_name": "6.4.x", "version_value": "6.4.2"}]}}]}, "vendor_name": "Avaya"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-502: Deserialization of Untrusted Data"}]}]}, "references": {"reference_data": [{"name": "https://downloads.avaya.com/css/P8/documents/101052865", "refsource": "CONFIRM", "url": "https://downloads.avaya.com/css/P8/documents/101052865"}]}, "source": {"advisory": "ASA-2018-296"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T10:01:53.739Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://downloads.avaya.com/css/P8/documents/101052865"}]}]}, "cveMetadata": {"assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "assignerShortName": "avaya", "cveId": "CVE-2018-15616", "datePublished": "2018-10-17T19:00:00.000Z", "dateReserved": "2018-08-21T00:00:00.000Z", "dateUpdated": "2024-08-05T10:01:53.739Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Avaya Aura\u00ae System Platform", "vendor": "Avaya", "versions": [{"lessThanOrEqual": "6.3.9", "status": "affected", "version": "6.3.x", "versionType": "custom"}, {"lessThanOrEqual": "6.4.2", "status": "affected", "version": "6.4.x", "versionType": "custom"}]}], "source": "securityalerts@avaya.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:avaya:avaya_aura_system_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "E14F2397-C0C9-4604-86A3-0366422C100E", "versionEndIncluding": "6.3.9", "versionStartIncluding": "6.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:h:avaya:avaya_aura_system_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "B23E0CE3-915A-4194-A10B-E9DEDAECAFAC", "versionEndIncluding": "6.4.2", "versionStartIncluding": "6.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2."}, {"lang": "es", "value": "Una vulnerabilidad en el componente Web UI de Avaya Aura System Platform podr\u00eda permitir que un usuario remoto no autenticado realice un ataque de deserializaci\u00f3n dirigida que podr\u00eda resultar en la ejecuci\u00f3n remota de c\u00f3digo. Las versiones afectadas de System Platform incluyen de la versi\u00f3n 6.3.0 a la 6.3.9 y desde la versi\u00f3n 6.4.0 hasta la 6.4.2."}], "id": "CVE-2018-15616", "lastModified": "2026-06-17T01:42:50.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 6.0, "source": "securityalerts@avaya.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-10-17T18:29:01.083", "references": [{"source": "securityalerts@avaya.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://downloads.avaya.com/css/P8/documents/101052865"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://downloads.avaya.com/css/P8/documents/101052865"}], "sourceIdentifier": "securityalerts@avaya.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "securityalerts@avaya.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}