CVE-2023-3722

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 19, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-372209.8Synel Terminals - CWE-494: Download of Code Without Integrity Check CVE-2023-372216.17Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').CVE-2023-372224.8Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilege CVE-2023-372235.4Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticated CVE-2023-372245.5An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information CVE-2023-372256.1Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.CVE-2023-372269.8Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.CVE-2023-372279.8Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.CVE-2023-372298.8Loftware Spectrum before 5.1 allows SSRF.CVE-2023-372308.8Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.CVE-2023-372319.8Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.CVE-2023-372327.5Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor.