Vulnerability · Published Jul 18, 2023 · Assigned by avaya
CVE-2023-3527Avaya Call Management System CSV injection vulnerability
Medium 6.8
In plain English
A medium-severity security flaw in Avaya Call Management System from Avaya. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.6%top 52.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Avaya | Avaya Call Management System | 19.x.x.x |
Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L