cnvd - cnvd-2021-39570

CNVD-2021-39570

Vulnerability from cnvd - Published: 2021-06-04

Title

Avaya Equinox Conferencing存在未明漏洞

Description

Avaya Equinox Conferencing是美国Avaya公司的一个提供会议支持的软件。该软件是包括所有Avaya软客户端与Avaya Aura Conferencing和Scopia的融合，适用于手机，浏览器，台式机和会议室系统的通用解决方案。 Avaya Equinox Conferencing Management component 3.x系列3.17之前版本存在安全漏洞，攻击者可利用该漏洞访问屏幕共享和白板会话。

Severity

中

Patch Name

Avaya Equinox Conferencing存在未明漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://support.avaya.com/

Reference

https://support.avaya.com/css/P8/documents/101075574

Impacted products

Name
Avaya Equinox Conferencing >3.*，<3.17

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-7038",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-7038"
    }
  },
  "description": "Avaya Equinox Conferencing\u662f\u7f8e\u56fdAvaya\u516c\u53f8\u7684\u4e00\u4e2a\u63d0\u4f9b\u4f1a\u8bae\u652f\u6301\u7684\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u662f\u5305\u62ec\u6240\u6709Avaya\u8f6f\u5ba2\u6237\u7aef\u4e0eAvaya Aura Conferencing\u548cScopia\u7684\u878d\u5408\uff0c\u9002\u7528\u4e8e\u624b\u673a\uff0c\u6d4f\u89c8\u5668\uff0c\u53f0\u5f0f\u673a\u548c\u4f1a\u8bae\u5ba4\u7cfb\u7edf\u7684\u901a\u7528\u89e3\u51b3\u65b9\u6848\u3002\n\nAvaya Equinox Conferencing Management component 3.x\u7cfb\u52173.17\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u5c4f\u5e55\u5171\u4eab\u548c\u767d\u677f\u4f1a\u8bdd\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://support.avaya.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-39570",
  "openTime": "2021-06-04",
  "patchDescription": "Avaya Equinox Conferencing\u662f\u7f8e\u56fdAvaya\u516c\u53f8\u7684\u4e00\u4e2a\u63d0\u4f9b\u4f1a\u8bae\u652f\u6301\u7684\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u662f\u5305\u62ec\u6240\u6709Avaya\u8f6f\u5ba2\u6237\u7aef\u4e0eAvaya Aura Conferencing\u548cScopia\u7684\u878d\u5408\uff0c\u9002\u7528\u4e8e\u624b\u673a\uff0c\u6d4f\u89c8\u5668\uff0c\u53f0\u5f0f\u673a\u548c\u4f1a\u8bae\u5ba4\u7cfb\u7edf\u7684\u901a\u7528\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nAvaya Equinox Conferencing Management component 3.x\u7cfb\u52173.17\u4e4b\u524d\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u5c4f\u5e55\u5171\u4eab\u548c\u767d\u677f\u4f1a\u8bdd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Avaya Equinox Conferencing\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Avaya Equinox Conferencing \u003e3.*\uff0c\u003c3.17"
  },
  "referenceLink": "https://support.avaya.com/css/P8/documents/101075574",
  "serverity": "\u4e2d",
  "submitTime": "2021-06-04",
  "title": "Avaya Equinox Conferencing\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2020-7038 (GCVE-0-2020-7038)

Vulnerability from cvelistv5 – Published: 2021-04-28 21:30 – Updated: 2024-09-16 21:04

Summary

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-284 - Improper Access Control CWE-200: Information Exposure

Assigner

avaya

References

URL

Tags

https://support.avaya.com/css/P8/documents/101075574

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Avaya	Avaya Meetings Management	Affected: 3.x , < 3.17 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:18:02.671Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.avaya.com/css/P8/documents/101075574"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Avaya Meetings Management",
          "vendor": "Avaya",
          "versions": [
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-04-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control\nCWE-200: Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-28T21:30:21",
        "orgId": "9d670455-bdb5-4cca-a883-5914865f5d96",
        "shortName": "avaya"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.avaya.com/css/P8/documents/101075574"
        }
      ],
      "source": {
        "advisory": "ASA-2021-036"
      },
      "title": "Avaya Meetings Server Information Disclosure vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "securityalerts@avaya.com",
          "DATE_PUBLIC": "2021-04-28T06:00:00.000Z",
          "ID": "CVE-2020-7038",
          "STATE": "PUBLIC",
          "TITLE": "Avaya Meetings Server Information Disclosure vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Avaya Meetings Management",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "3.x",
                            "version_value": "3.17"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Avaya"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen sharing and whiteboard sessions. The affected versions of Management component of Avaya Equinox Conferencing include all 3.x versions before 3.17. Avaya Equinox Conferencing is now offered as Avaya Meetings Server."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284: Improper Access Control\nCWE-200: Information Exposure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.avaya.com/css/P8/documents/101075574",
              "refsource": "CONFIRM",
              "url": "https://support.avaya.com/css/P8/documents/101075574"
            }
          ]
        },
        "source": {
          "advisory": "ASA-2021-036"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96",
    "assignerShortName": "avaya",
    "cveId": "CVE-2020-7038",
    "datePublished": "2021-04-28T21:30:21.281149Z",
    "dateReserved": "2020-01-14T00:00:00",
    "dateUpdated": "2024-09-16T21:04:25.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-39570

CVE-2020-7038 (GCVE-0-2020-7038)

Tags

Sightings

Nomenclature