--- title: "Avaya aura communication manager vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/avaya/aura-communication-manager type: product description: "Avaya aura communication manager has 10 published CVEs, 0 in CISA KEV and 2 with public exploits." updated: 2022-10-12 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Avaya aura communication manager vulnerabilities Vendor: [Avaya](https://radicalnotion.ai/vendor/avaya) - **Published CVEs:** 10 - **In CISA KEV:** 0 - **With a public exploit:** 2 - **With a patch:** 10 - **Average CVSS:** 7.5 - **First CVE:** 2009-11-16 - **Latest CVE:** 2022-10-12 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 8 | | Medium | 2 | | Low | 0 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-476](https://radicalnotion.ai/cwe/cwe-476) | NULL Pointer Dereference | 2 | | [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 1 | | [CWE-269](https://radicalnotion.ai/cwe/cwe-269) | Improper Privilege Management | 1 | | [CWE-284](https://radicalnotion.ai/cwe/cwe-284) | Improper Access Control | 1 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 1 | | [CWE-399](https://radicalnotion.ai/cwe/cwe-399) | Resource Management Errors | 1 | | [CWE-401](https://radicalnotion.ai/cwe/cwe-401) | Missing Release of Memory after Effective Lifetime | 1 | | [CWE-120](https://radicalnotion.ai/cwe/cwe-120) | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2018 | 1 | | 2019 | 2 | | 2020 | 1 | | 2021 | 0 | | 2022 | 1 | ## Affected versions | Version | Kind | CVEs | | --- | --- | --- | | 5.2 | range | 5 | | 6.3.0.1 \<= v \<= 6.3.17.0 | range | 2 | | 10.1.0.0 | range | 1 | | 6.0 \<= v \<= 6.3.117.0 | range | 1 | | 7.0 | range | 1 | | 7.0 \<= v \< 7.1.3.1 | range | 1 | | 7.0 \<= v \< 7.1.3.2 | range | 1 | | 7.0 \<= v \<= 7.1.3.4 | range | 1 | | 8.0 \<= v \< 8.0.1 | range | 1 | | 8.0 \<= v \< 8.1.0.0 | range | 1 | | 8.0 \<= v \< 8.1.3.4 | range | 1 | | 7.1.3.1 | patched | 1 | | 7.1.3.2 | patched | 1 | | 8.0.1 | patched | 1 | | 8.1.0.0 | patched | 1 | | 8.1.3.4 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2022-2249 | Avaya Aura Communication Manager Privilege Escalation Vulnerabilities | high | 7.7 | No | No | Yes | | CVE-2020-7029 | Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability | high | 8.8 | No | No | Yes | | CVE-2016-5285 | - | high | 7.5 | No | No | Yes | | CVE-2018-15617 | Communication Manager Denial of Service | high | 7.5 | No | No | Yes | | CVE-2018-15611 | Communication Manager Local Administrator PrivEsc | medium | 6.7 | No | No | Yes | | CVE-2010-2943 | - | high | 8.1 | No | Yes | Yes | | CVE-2010-2942 | - | medium | 5.5 | No | No | Yes | | CVE-2010-2798 | - | high | 7.8 | No | No | Yes | | CVE-2010-2492 | - | high | 7.8 | No | No | Yes | | CVE-2009-3939 | - | high | 7.1 | No | Yes | Yes | ## Frequently asked questions ### How many CVEs does Avaya aura communication manager have? Avaya aura communication manager has 10 published CVE records since 2009. ### How many Avaya aura communication manager CVEs are in CISA KEV? None of Avaya aura communication manager's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Avaya aura communication manager vulnerabilities? Yes — 2 of Avaya aura communication manager's CVEs have a known public exploit. ### Which versions of Avaya aura communication manager are affected? 16 distinct Avaya aura communication manager versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Avaya aura communication manager CVEs? Avaya aura communication manager's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control). ### What is the average severity of Avaya aura communication manager CVEs? The average CVSS base score across Avaya aura communication manager's scored CVEs is 7.5. ## Other products from this vendor - [Communication Manager](https://radicalnotion.ai/vendor/avaya/communication-manager) (18 CVEs) - [modular messaging message storage server](https://radicalnotion.ai/vendor/avaya/modular-messaging-message-storage-server) (15 CVEs) - [s8300](https://radicalnotion.ai/vendor/avaya/s8300) (11 CVEs) - [s8500](https://radicalnotion.ai/vendor/avaya/s8500) (11 CVEs) - [s8700](https://radicalnotion.ai/vendor/avaya/s8700) (11 CVEs) - [converged communications server](https://radicalnotion.ai/vendor/avaya/converged-communications-server) (10 CVEs) - [definity one media server](https://radicalnotion.ai/vendor/avaya/definity-one-media-server) (10 CVEs) - [s8100](https://radicalnotion.ai/vendor/avaya/s8100) (10 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/avaya/aura-communication-manager). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.