Vulnerability Description
System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, aka SMGR-26896.
CVSS Score
7.5
HIGH
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Avaya | Aura | <= 7.1.1 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/102940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040329Third Party AdvisoryVDB Entry
- https://downloads.avaya.com/css/P8/documents/101038598Vendor Advisory
- http://www.securityfocus.com/bid/102940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040329Third Party AdvisoryVDB Entry
- https://downloads.avaya.com/css/P8/documents/101038598Vendor Advisory
FAQ
What is CVE-2018-6635?
CVE-2018-6635 is a vulnerability with a CVSS score of 7.5 (HIGH). System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows remote attackers to bypass intended Remote Method Invocation (RMI) restrictions, ak...
How severe is CVE-2018-6635?
CVE-2018-6635 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-6635?
Check the references section above for vendor advisories and patch information. Affected products include: Avaya Aura.