title: Communication Manager Local Administrator PrivEsc
description: A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.
problem types: CWE-284: Improper Access Control
affected:
{
product: Communication Manager
vendor: Avaya
versions:
lessThan: 7.x*, status: affected, version: 7.1.3.1, versionType: custom
lessThan: 6.3.x*, status: affected, version: 6.3.x, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.0
]