CVE-2021-25649

** UNSUPPORTED WHEN ASSIGNED ** An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility Services.

CVSS v3 4.9 MEDIUM
CVSS v2.0 2.1 LOW

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.avaya.com/css/P8/documents/101072728	Vendor Advisory
https://support.avaya.com/css/P8/documents/101072728	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:avaya:aura_utility_services:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:55

Type	Values Removed	Values Added
References	~~() https://support.avaya.com/css/P8/documents/101072728 - Vendor Advisory~~	() https://support.avaya.com/css/P8/documents/101072728 - Vendor Advisory
CVSS	v2 : ~~2.1~~ v3 : ~~5.5~~	v2 : 2.1 v3 : 4.9

29 Jun 2021, 16:33

Type	Values Removed	Values Added
References	~~(MISC) https://support.avaya.com/css/P8/documents/101072728 -~~	(MISC) https://support.avaya.com/css/P8/documents/101072728 - Vendor Advisory
CWE		NVD-CWE-Other
CPE		cpe:2.3:a:avaya:aura_utility_services::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 2.1 v3 : 5.5

24 Jun 2021, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-06-24 09:15

Updated : 2024-11-21 05:55

NVD link : CVE-2021-25649

Mitre link : CVE-2021-25649

CVE.ORG link : CVE-2021-25649

JSON object : View

Products Affected

avaya

aura_utility_services

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-Other

{"id": "CVE-2021-25649", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "securityalerts@avaya.com"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "securityalerts@avaya.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2021-06-24T09:15:10.683", "references": [{"url": "https://support.avaya.com/css/P8/documents/101072728", "tags": ["Vendor Advisory"], "source": "securityalerts@avaya.com"}, {"url": "https://support.avaya.com/css/P8/documents/101072728", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "securityalerts@avaya.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerability may potentially allow any local user to access system functionality and configuration information that should only be available to a privileged user. Affects all 7.x versions of Avaya Aura Utility Services"}, {"lang": "es", "value": "** NO COMPATIBLE CUANDO SE ASIGN\u00d3 ** Se ha detectado una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n en la administraci\u00f3n de directorios y archivos de Avaya Aura Utility Services. Esta vulnerabilidad podr\u00eda permitir potencialmente a cualquier usuario local acceder a la funcionalidad del sistema y a la informaci\u00f3n de configuraci\u00f3n que s\u00f3lo deber\u00eda estar disponible para un usuario con privilegios. Afecta a todas las versiones 7.x de Avaya Aura Utility Services"}], "lastModified": "2024-11-21T05:55:12.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:avaya:aura_utility_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8D5F626-3A36-409F-B3FE-18A35EC99BAB", "versionEndIncluding": "7.1.3", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "securityalerts@avaya.com"}