CVE-2023-3527: Avaya Call Management System CSV injection vulnerability
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software
such as Microsoft Excel.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-3527.
What is the title of the vulnerability?
The title of the vulnerability is 'A CSV injection vulnerability in Avaya Call Management System (CMS) Supervisor web app.'
What is the severity of CVE-2023-3527?
The severity of CVE-2023-3527 is medium with a CVSS score of 6.8.
How does the vulnerability affect Avaya Call Management System (CMS)?
The vulnerability affects Avaya Call Management System (CMS) versions up to 20.0.0.0.
Is there a fix available for CVE-2023-3527?
To fix CVE-2023-3527, it is recommended to update Avaya Call Management System (CMS) to a version that is not affected by the vulnerability.