Avaya: >> Call Management System >> 20.0 Security Vulnerabilities
An improper input validation discovered in
Avaya Call Management System
could allow an unauthorized
remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
CVSS Score
9.9
EPSS Score
0.002
Published
2025-06-10
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software
such as Microsoft Excel.
CVSS Score
6.8
EPSS Score
0.001
Published
2023-07-18