CVE-2022-2975: Avaya Aura Application Enablement Services weak permissions in web application

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-06 · updated 2026-06-17
Weakness: CWE-269

Description

A vulnerability related to weak permissions was detected in Avaya Aura Application Enablement Services web application, allowing an administrative user to modify accounts leading to execution of arbitrary code as the root user. This issue affects Application Enablement Services versions 8.0.0.0 through 8.1.3.4 and 10.1.0.0 through 10.1.0.1. Versions prior to 8.0.0.0 are end of manufacturing support and were not evaluated.

Affected products

Avaya Aura Application Enablement Services: from 8.0.0.0 before 8.1.3.5; from 10.1.0.0 before 10.1.0.2 — fixed in 10.1.0.2, 8.1.3.5

How to fix

Upgrade to a fixed version: Avaya Aura Application Enablement Services 10.1.0.2, 8.1.3.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-2975 or the next vulnerability affects your stack