CVE-2010-3280 The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and uncond...
MediumCVSS 6.9
EPSS 0.96%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an authorized session, which allows remote attackers to monitor or reconfigure Contact Center operations via a modified client application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| alcatel-lucent ccagent | <= 8.0 | No fix listed |
| alcatel-lucent ccagent | = 7.1 | No fix listed |
| alcatel-lucent omnitouch contact center | All versions | No fix listed |
References
- 41547 third-party-advisory vendor-advisory
- www.alcatel-lucent.com vendor-advisory
- www.nruns.com
- 20100920 n.runs-SA-2010.001 - Alcatel-Lucent - unauthenticated administrative access to CTI CCA Server mailing-list
- 43340 vdb-entry
- ADV-2010-2459 vdb-entry vendor-advisory
- omnitouch-callcenter-info-disclosure(61920) vdb-entry