Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2018-15614— IP Office one-X Portal XSS

Quick assessment

Affected
Avaya IP Office
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Avaya IP Office是美国Avaya公司的一套可堆叠、可扩展的单一小型企业通信系统。该系统可通过基于PC的单一门户管理语音通信、即时消息和电子邮件，并支持多种拖放式应用工具。one-x Portal是其中的一个基于Web的语音通信功能组件。 Avaya IP Office 10.0版本至10.1 SP3版本和11.0版本中的one-x Portal组件存在跨站脚本漏洞。远程攻击者可借助Conference Scheduler Service中的字段利用该漏洞执行恶意的脚本，捕获用户会话令牌或凭证

AI Predicted 4.3 Difficulty: Easy EPSS 0.62% · P48

Possible ATT&CK Techniques 1 AI

T1189.003
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2018-15614

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IP Office one-X Portal XSS
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 versions prior to 11.0 SP1.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Avaya IP Office one-x Portal组件跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Avaya IP Office是美国Avaya公司的一套可堆叠、可扩展的单一小型企业通信系统。该系统可通过基于PC的单一门户管理语音通信、即时消息和电子邮件，并支持多种拖放式应用工具。one-x Portal是其中的一个基于Web的语音通信功能组件。 Avaya IP Office 10.0版本至10.1 SP3版本和11.0版本中的one-x Portal组件存在跨站脚本漏洞。远程攻击者可借助Conference Scheduler Service中的字段利用该漏洞执行恶意的脚本，捕获用户会话令牌或凭证
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Avaya IP Office 11.x ~ 11.0 SP1 -

II. Public POCs for CVE-2018-15614

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2018-15614

请登录查看更多情报信息。

Vendor Advisories for CVE-2018-15614 (1)

IV. Related Vulnerabilities

Same product: IP Office
Same vendor: Avaya
Same weakness: CWE-79

V. Comments for CVE-2018-15614

No comments yet

Leave a comment