CVE-2024-12756 - CVE House

Status published High CVE-2024-12756

Avaya Spaces HTML injection (HTMLi) Vulnerability

7.3 CVSS

Vulnerability Description

An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12756

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Waleed Elnawawy from Dubai Islamic Bank
Mostafa Noureldin from Liquid C2 Egypt

References

https://support.avaya.com/css/public/documents/101091836

More from Avaya

View All →

CVE-2025-1041

Avaya Call Management System RCE vulnerability

Critical 9.9

CVE-2024-7480

Improper access control in Avaya Aura System Manager

Medium 4.2

CVE-2024-7477

Avaya Aura System Manager SQL injection vulnerability

Medium 6.5

CVE-2024-4197

Avaya IP Office One-X Portal File Upload Vulnerability

Critical 9.9

CVE-2024-4196

Avaya IP Office Web Control RCE Vulnerability

Critical 10

Affected Vendor

Avaya

View all reports →

Affected Software

Avaya Spaces

Vulnerable Versions:

Timeline

Official Publish: February 11th, 2025

Last Modified: October 1st, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-1287

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.