CVE-2018-15612: Orchestration Designer Runtime Config CSRF

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-21 · updated 2026-06-17
Weakness: CWE-352

Description

A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.

Affected products

Avaya Orchestration Designer: before 7.2.1 — fixed in 7.2.1

How to fix

Upgrade to a fixed version: Avaya Orchestration Designer 7.2.1. Check the vendor advisory for mitigations.

References

https://downloads.avaya.com/css/P8/documents/101052293
https://downloads.avaya.com/css/P8/documents/101052293

Get alerted when CVE-2018-15612 or the next vulnerability affects your stack