CVE-2019-7003
ACM SQL Injection
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jul 11, 2019
- Updated
- Sep 17, 2024
- Reserved
- Jan 28, 2019
Description
A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.3 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N | avaya |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Avaya Control ManagerAvaya |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.