CVE-2008-6707

Avaya SIP Enablement Services 3.x-4.0 - Unauthenticated Sensitive Information Exposure

Title source: llm
STIX 2.1

Description

The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an "unnecessary default application," (4) unspecified scripts in the states folder, (5) an unspecified "default application" that lists server configuration, and (6) "full system help."

References (19)

Core 19
Core References
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=86
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43384
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43393
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1943/references
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30751
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/46598
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=88
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=90
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=87
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43381
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29939
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/46599
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/46600
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=91
Various Sources x_refsource_misc
http://www.voipshield.com/research-details.php?id=89
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43394
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43395
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43389

Scores

EPSS 0.0150
EPSS Percentile 71.0%

Details

CWE
CWE-287
Status published
Products (10)
avaya/communication_manager 3.1
avaya/communication_manager 3.1.1
avaya/communication_manager 3.1.2
avaya/communication_manager 3.1.3
avaya/communication_manager 3.1.4 (3 CPE variants)
avaya/communication_manager 3.1.5 (2 CPE variants)
avaya/sip_enablement_services 3.0
avaya/sip_enablement_services 3.1
avaya/sip_enablement_services 3.1.1
avaya/sip_enablement_services 4.0
Published Apr 10, 2009
Tracked Since Feb 18, 2026