VULNERABILITY INTELLIGENCE

CVE-2019-7003

CVSS score10 CRITICAL

EPSS probability1.46%

CISA KEVNot currently listed

Published2019-07-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Description

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

Weakness classification

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references

securityalerts@avaya.com — Broken Link, Third Party Advisory, VDB Entry
securityalerts@avaya.com — Vendor Advisory
nvd@nist.gov — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory