CVE-2023-3722 HIGH

CVE-2023-3722: Avaya Aura Device Services Remote Code Execution

Vendor Avaya

Product Aura Device Services

Weakness CWE-434 · Unrestricted file upload

Published July 19, 2023

Last update October 22, 2024

View on NVD All CVEs

CVSS base score

8.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

What the vulnerability does

01Description

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Key dates

02Disclosure timeline

July 19, 2023 CVE published

October 22, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-3722 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-52376 WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerability CVE-2023-3806 SourceCodester House Rental and Property Listing System btn_functions.php unrestricted upload CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php) CVE-2025-9841 code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload CVE-2025-10147 Podlove Podcast Publisher <= 4.2.6 - Unauthenticated Arbitrary File Upload