CVE-2023-3527

MEDIUM EPSS 41.3%

Published Jul 18, 20232y ago · Modified Jun 17, 20262w ago

6.8 CVSS 3.1

Medium

Published Jul 18, 2023 2y ago

Last Modified Jun 17, 2026 2w ago

Description

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.

CVSS Details

Base Score

6.8

Exploitability

0.9

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required High

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

41.3% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-1236

Affected Products 1

Vendor	Product	Version	Range
avaya	call_management_system	*	<20.0.0.0

References 1

download.avaya.com https://download.avaya.com/css/public/documents/101086364

PatchVendor Advisory

Remediation

download.avaya.com https://download.avaya.com/css/public/documents/101086364

PatchVendor Advisory