CVE-2018-6635: Weak Encryption
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Avaya Aura System Managerto a version that resolves this vulnerability.Fixed in 7.1.2Patch SMGR-26896
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-6635.
What software is affected by this vulnerability?
Avaya Aura versions up to and including 7.1.1 are affected.
What is the severity of CVE-2018-6635?
The severity of CVE-2018-6635 is high with a CVSS score of 7.5.
How does CVE-2018-6635 allow attackers to bypass restrictions?
CVE-2018-6635 allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions by not properly using SSL in conjunction with authentication.
How can I fix this vulnerability?
To fix CVE-2018-6635, it is recommended to upgrade Avaya Aura to version 7.1.2 or later.