| Vulnerability Name: | CCN-41733 | ||||||
| Published: | 2008-04-07 | ||||||
| Updated: | 2008-04-07 | ||||||
| Summary: | Avaya SIP Enablement Services (SES) is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the SIP server via SIP requests, which could allow the attacker to view, add, modify or delete information in the back-end database. | ||||||
| CVSS v3 Severity: | 5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
| ||||||
| CVSS v2 Severity: | 6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P) 5.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:H/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Data Manipulation | ||||||
| References: | Source: CCN Type: SA29744 Avaya SIP Enablement Services Multiple Vulnerabilities Source: CCN Type: ASA-2008-150 Input Validation Vulnerabilities in Avaya SES SIP Server Source: CCN Type: Avaya Web site Telecommunication Systems by Avaya Source: CCN Type: BID-28687 Avaya SIP Enablement Services (SES) Server Multiple Input Validation Vulnerabilities Source: CCN Type: VoIPshield Systems Inc Web site SES SIP SQL Injection Source: XF Type: UNKNOWN avaya-ses-sip-sql-injection(41733) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||