CVE-2008-3777
Summary
| CVE | CVE-2008-3777 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-08-25 21:41:00 UTC |
| Updated | 2017-08-08 01:32:00 UTC |
| Description | The SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, writes account names and passwords to the (1) alarm and (2) system logs during failed login attempts, which allows local users to obtain login credentials by reading these logs. |
Risk And Classification
Problem Types: CWE-200
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Avaya | Communication Manager | 5.0 | All | All | All |
| Application | Avaya | Communication Manager | 5.0 | All | All | All |
| Hardware | Avaya | S8300c Server | All | All | All | All |
| Hardware | Avaya | S8300c Server | All | All | All | All |
| Application | Avaya | Sip Enablement Services | 5.0 | All | All | All |
| Application | Avaya | Sip Enablement Services | 5.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Avaya SES Authentication Bypass Vulnerability and Information Disclosure Weakness | BID | www.securityfocus.com | |
| ASA-2008-347 | CONFIRM | support.avaya.com | |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.