CVE-2020-7029: Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging. This vulnerability could allow an unauthenticated remote attacker to perform Web administration actions with the privileged level of the authenticated user. Affected versions of Communication Manager are 7.0.x, 7.1.x prior to 7.1.3.5 and 8.0.x. Affected versions of Messaging are 7.0.x, 7.1 and 7.1 SP1.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7029?
CVE-2020-7029 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in the System Management Interface Web component of Avaya Aura Communication Manager and Avaya Aura Messaging.
How does CVE-2020-7029 affect Avaya Aura Communication Manager and Avaya Aura Messaging?
CVE-2020-7029 allows an unauthenticated remote attacker to perform Web administration actions with privileged access, potentially compromising the security of the affected systems.
What is the severity of CVE-2020-7029?
CVE-2020-7029 has a severity rating of 8.8 (high).
Is there a fix available for CVE-2020-7029?
Yes, Avaya has released a fix for CVE-2020-7029. Users are advised to apply the necessary patches or updates provided by Avaya to mitigate this vulnerability.
Where can I find more information about CVE-2020-7029?
More information about CVE-2020-7029 can be found on the Avaya support website at https://support.avaya.com/css/P8/documents/101070201.