CVE-2024-4196 - Vulnerability Details - OpenCVE

An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Avaya	Ip Office

Configuration 1 [-]

cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://download.avaya.com/css/public/documents/101090768

History

Tue, 21 Jan 2025 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Avaya Avaya ip Office
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:avaya:ip_office::::::::
Vendors & Products		Avaya Avaya ip Office

MITRE

Status: PUBLISHED

Assigner: avaya

Published: 2024-06-25T04:00:30.307Z

Updated: 2024-08-01T20:33:52.951Z

Reserved: 2024-04-25T16:34:11.466Z

Link: CVE-2024-4196

Vulnrichment

Updated: 2024-08-01T20:33:52.951Z

NVD

Status : Analyzed

Published: 2024-06-25T04:15:16.580

Modified: 2025-01-21T14:31:31.413

Link: CVE-2024-4196

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-4196", "assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "state": "PUBLISHED", "assignerShortName": "avaya", "dateReserved": "2024-04-25T16:34:11.466Z", "datePublished": "2024-06-25T04:00:30.307Z", "dateUpdated": "2024-08-01T20:33:52.951Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["Web Control"], "product": "IP Office", "vendor": "Avaya", "versions": [{"lessThan": "11.1.3.1", "status": "affected", "version": "0", "versionType": "11.1.3.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An <span style=\"background-color: rgb(255, 255, 255);\">improper input validation vulnerability </span> was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.<br><br>"}], "value": "An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1."}], "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "shortName": "avaya", "dateUpdated": "2024-06-25T04:00:30.307Z"}, "references": [{"url": "https://download.avaya.com/css/public/documents/101090768"}], "source": {"defect": ["IPOFFICE-171836"], "discovery": "EXTERNAL"}, "title": "Avaya IP Office Web Control RCE Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "avaya", "product": "ip_office", "cpes": ["cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "11.1.3.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-15T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-4196"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T03:55:31.961Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.951Z"}, "title": "CVE Program Container", "references": [{"url": "https://download.avaya.com/css/public/documents/101090768", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://download.avaya.com/css/public/documents/101090768", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:33:52.951Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-4196", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-26T14:57:50.348551Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*"], "vendor": "avaya", "product": "ip_office", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "11.1.3.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-26T18:49:53.630Z"}}], "cna": {"title": "Avaya IP Office Web Control RCE Vulnerability", "source": {"defect": ["IPOFFICE-171836"], "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-253", "descriptions": [{"lang": "en", "value": "CAPEC-253 Remote Code Inclusion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Avaya", "modules": ["Web Control"], "product": "IP Office", "versions": [{"status": "affected", "version": "0", "lessThan": "11.1.3.1", "versionType": "11.1.3.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://download.avaya.com/css/public/documents/101090768"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.", "supportingMedia": [{"type": "text/html", "value": "An <span style=\"background-color: rgb(255, 255, 255);\">improper input validation vulnerability </span> was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "shortName": "avaya", "dateUpdated": "2024-06-25T04:00:30.307Z"}}}, "cveMetadata": {"cveId": "CVE-2024-4196", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:33:52.951Z", "dateReserved": "2024-04-25T16:34:11.466Z", "assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "datePublished": "2024-06-25T04:00:30.307Z", "assignerShortName": "avaya"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*", "matchCriteriaId": "D254641E-9158-4E16-8B8C-800AEC6F8FBB", "versionEndExcluding": "11.1.3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1."}, {"lang": "es", "value": "Se descubri\u00f3 una vulnerabilidad de validaci\u00f3n de entrada incorrecta en Avaya IP Office que podr\u00eda permitir la ejecuci\u00f3n remota de comandos o c\u00f3digos a trav\u00e9s de una solicitud web especialmente manipulada al componente de control web. Las versiones afectadas incluyen todas las versiones anteriores a la 11.1.3.1."}], "id": "CVE-2024-4196", "lastModified": "2025-01-21T14:31:31.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "securityalerts@avaya.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-25T04:15:16.580", "references": [{"source": "securityalerts@avaya.com", "tags": ["Vendor Advisory"], "url": "https://download.avaya.com/css/public/documents/101090768"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://download.avaya.com/css/public/documents/101090768"}], "sourceIdentifier": "securityalerts@avaya.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "securityalerts@avaya.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}