CVE-2023-3527 — Avaya Call Management System CSV injection vulnerability

CVE-2023-3527

Avaya Call Management System CSV injection vulnerability PUBLISHED

Description (CNA)

A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a spreadsheet software such as Microsoft Excel.

Affected (CNA)

Vendor / product	Versions
Avaya / Avaya Call Management System	affected 19.x.x.x

CWE

CWE-1236

References

https://download.avaya.com/css/public/documents/101086364

ADP enrichment

CVE

No English description supplied.

https://download.avaya.com/css/public/documents/101086364

CISA-ADP

No English description supplied.

No references supplied.