CVE-2019-7003: ACM SQL Injection

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-11 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacker to execute arbitrary SQL commands and retrieve sensitive data related to other users on the system. Affected versions of Avaya Control Manager include 7.x and 8.0.x versions prior to 8.0.4.0. Unsupported versions not listed here were not evaluated.

Affected products

Avaya Control Manager: from 7.0 before 8.0.4.0 — fixed in 8.0.4.0

How to fix

Upgrade to a fixed version: Avaya Control Manager 8.0.4.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/109134
https://downloads.avaya.com/css/P8/documents/101059368
https://support.avaya.com/documents/documents-by-contenttype.action?product_id=P0941&product_name=Control+Manager&release_number=releaseId&contentType=ReleaseNotes
http://www.securityfocus.com/bid/109134
https://downloads.avaya.com/css/P8/documents/101059368

Get alerted when CVE-2019-7003 or the next vulnerability affects your stack