Description
A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software
such as Microsoft Excel.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Avaya | Avaya Call Management System | 19.x.x.x | — |
Advisories 1
- WID-SEC-2023-1798 Avaya CMS: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 18, 2023