CVE-2018-6635

HIGH

Avaya Aura < 7.1.1 - Inadequate Encryption Strength in System Manager

Title source: llm

Description

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1040329

Vendor Advisory x_refsource_confirm

https://downloads.avaya.com/css/P8/documents/101038598

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/102940

Scores

CVSS v3 7.5

EPSS 0.0120

EPSS Percentile 64.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-326

Status published

Products (1)

avaya/aura < 7.1.1

Published Feb 05, 2018

Tracked Since Feb 18, 2026