title: Unauthenticated Information Disclosure Vulnerability in IP Office
description: A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 through 11.0.4.2.
problem types: CWE-200: Information Exposure
affected:
{
product: IP Office
vendor: Avaya
versions:
lessThanOrEqual: 10.1.0.7, status: affected, version: 10.0, versionType: custom
lessThanOrEqual: 11.0.4.2, status: affected, version: 11.0, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.0
]