CVE-2022-2249 Avaya Aura Communication Manager Privilege Escalation Vulnerabilities

MediumCVSS 6.7 EPSS 0.21%

Published: 2022-10-12 23:02 (approximate time: when CVE Radar first recorded it)
Updated: 2026-06-17 07:41
Exploit status: No public exploit known

Description

Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0.

Affected products

Product	Affected versions	Fixed in
Avaya Aura Communication Manager	= 10.1.0.0	No fix listed
Avaya Aura Communication Manager	>= 8.x, <= 8.1.3.3	No fix listed
avaya aura communication manager	>= 8.0, < 8.1.3.4	8.1.3.4
avaya aura communication manager	= 10.1.0.0	No fix listed

References

download.avaya.com release-notes vendor-advisory

CVSS v3.1

6.7 Medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (3)

v3.1 6.7 · nvd@nist.gov
v3.1 7.7 · avaya
v3.1 7.7 · securityalerts@avaya.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.21% (percentile 10.6)
CWE: CWE-269 Improper Privilege Management

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.