CVE-2023-3722: Avaya Aura Device Services Remote Code Execution
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Avaya Aura Device Servicesto a version that resolves this vulnerability.Fixed in 8.1.4.1
Event History
Frequently Asked Questions
What is CVE-2023-3722?
CVE-2023-3722 is an OS command injection vulnerability found in the Avaya Aura Device Services Web application.
How does CVE-2023-3722 impact Avaya Aura Device Services?
CVE-2023-3722 could allow remote code execution as the Web server user via a malicious uploaded file, potentially leading to unauthorized access and control of the affected system.
What version of Avaya Aura Device Services is affected by CVE-2023-3722?
Avaya Aura Device Services version 8.1.4.0 and earlier are affected by CVE-2023-3722.
How severe is CVE-2023-3722?
CVE-2023-3722 has a severity rating of 9.8 (critical).
Is there a fix available for CVE-2023-3722?
Yes, it is recommended to upgrade to a version later than 8.1.4.0 to mitigate the vulnerability. Please refer to the vendor's advisory for detailed instructions.