CVE-2022-2975 - CVE House
Back to Database
Status published High CVE-2022-2975

Avaya Aura Application Enablement Services weak permissions in web application

Vulnerability Description

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2975

Credits & Attribution

No credits recorded in the NVD database.

References

More from Avaya

View All →
CVE-2025-1041
Avaya Call Management System RCE vulnerability
Critical 9.9
CVE-2024-7480
Improper access control in Avaya Aura System Manager
Medium 4.2
CVE-2024-7477
Avaya Aura System Manager SQL injection vulnerability
Medium 6.5
CVE-2024-4197
Avaya IP Office One-X Portal File Upload Vulnerability
Critical 9.9
CVE-2024-4196
Avaya IP Office Web Control RCE Vulnerability
Critical 10

Affected Vendor

Affected Software

Avaya Aura Application Enablement Services
Vulnerable Versions:
10.1.x, 8.x

Timeline

Official Publish: October 6th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion