CVE-2018-15610
Summary
| CVE | CVE-2018-15610 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-09-12 21:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1 through 9.1 SP12, 10.0 through 10.0 SP7, and 10.1 through 10.1 SP2. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Avaya | Ip Office | 10.0 | All | All | All |
| Application | Avaya | Ip Office | 10.0 | sp1 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp2 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp3 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp4 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp5 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp6 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp7 | All | All |
| Application | Avaya | Ip Office | 10.1 | All | All | All |
| Application | Avaya | Ip Office | 10.1 | sp1 | All | All |
| Application | Avaya | Ip Office | 10.1 | sp2 | All | All |
| Application | Avaya | Ip Office | 9.1 | All | All | All |
| Application | Avaya | Ip Office | 9.1 | sp1 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp10 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp11 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp12 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp2 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp3 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp4 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp5 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp6 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp7 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp8 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp9 | All | All |
| Application | Avaya | Ip Office | 10.0 | All | All | All |
| Application | Avaya | Ip Office | 10.0 | sp1 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp2 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp3 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp4 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp5 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp6 | All | All |
| Application | Avaya | Ip Office | 10.0 | sp7 | All | All |
| Application | Avaya | Ip Office | 10.1 | All | All | All |
| Application | Avaya | Ip Office | 10.1 | sp1 | All | All |
| Application | Avaya | Ip Office | 10.1 | sp2 | All | All |
| Application | Avaya | Ip Office | 9.1 | All | All | All |
| Application | Avaya | Ip Office | 9.1 | sp1 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp10 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp11 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp12 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp2 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp3 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp4 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp5 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp6 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp7 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp8 | All | All |
| Application | Avaya | Ip Office | 9.1 | sp9 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ASA-2018-256 (CVE-2018-15610) | CONFIRM | downloads.avaya.com | Vendor Advisory |
| Avaya one-X 9.x / 10.0.x / 10.1.x Arbitrary File Disclosure / Deletion ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.