Read the docs
TI-2020-05671 Aliases CVE-2020-7030GHSA-jv7q-mm3q-m55p

IPO Information Disclosure

Priority LOW 27CWE-522Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-522.

Summary

A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component. Affected versions of IP Office include: 9.x, 10.0 through 10.1.0.7 and 11.0 though 11.0.4.3.

Why it matters now

EPSS 0.01044 64th percentileScored 2026-11-07
Fix Fixed IP Office (Avaya): 10.1.0.8, 11.0.4.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvayaIP Office9.x; 10.0 to before 10.1.0.8; 11.0 to before 11.0.4.310.1.0.8, 11.0.4.3Patch availableCNA
  • IP Office VendorAvaya Affected 9.x; 10.0 to before 10.1.0.8; 11.0 to before 11.0.4.3 Fixed in 10.1.0.8, 11.0.4.3 Patch available CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:*10.0 – 10.1.0.7; 11.0 – 11.0.4.2VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:-:*:*:*:*:*:*9.0VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp1:*:*:*:*:*:*9.0 sp1VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp10:*:*:*:*:*:*9.0 sp10VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp11:*:*:*:*:*:*9.0 sp11VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp12:*:*:*:*:*:*9.0 sp12VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp2:*:*:*:*:*:*9.0 sp2VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp3:*:*:*:*:*:*9.0 sp3VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp4:*:*:*:*:*:*9.0 sp4VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp5:*:*:*:*:*:*9.0 sp5VulnerableAvaya
  • cpe:2.3:a:avaya:ip_office:*:*:*:*:*:*:*:* Versions 10.0 – 10.1.0.7; 11.0 – 11.0.4.2 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:-:*:*:*:*:*:* Versions 9.0 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp1:*:*:*:*:*:* Versions 9.0 sp1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp10:*:*:*:*:*:* Versions 9.0 sp10 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp11:*:*:*:*:*:* Versions 9.0 sp11 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp12:*:*:*:*:*:* Versions 9.0 sp12 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp2:*:*:*:*:*:* Versions 9.0 sp2 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp3:*:*:*:*:*:* Versions 9.0 sp3 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp4:*:*:*:*:*:* Versions 9.0 sp4 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp5:*:*:*:*:*:* Versions 9.0 sp5 Vulnerable ·Avaya
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:avaya:ip_office:9.0:sp6:*:*:*:*:*:*9.0 sp6VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp7:*:*:*:*:*:*9.0 sp7VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp8:*:*:*:*:*:*9.0 sp8VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.0:sp9:*:*:*:*:*:*9.0 sp9VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:-:*:*:*:*:*:*9.1VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp1:*:*:*:*:*:*9.1 sp1VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp10:*:*:*:*:*:*9.1 sp10VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp11:*:*:*:*:*:*9.1 sp11VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp12:*:*:*:*:*:*9.1 sp12VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp3:*:*:*:*:*:*9.1 sp3VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp4:*:*:*:*:*:*9.1 sp4VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp5:*:*:*:*:*:*9.1 sp5VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp6:*:*:*:*:*:*9.1 sp6VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp7:*:*:*:*:*:*9.1 sp7VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp8:*:*:*:*:*:*9.1 sp8VulnerableAvaya
cpe:2.3:a:avaya:ip_office:9.1:sp9:*:*:*:*:*:*9.1 sp9VulnerableAvaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp6:*:*:*:*:*:* Versions 9.0 sp6 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp7:*:*:*:*:*:* Versions 9.0 sp7 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp8:*:*:*:*:*:* Versions 9.0 sp8 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.0:sp9:*:*:*:*:*:* Versions 9.0 sp9 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:-:*:*:*:*:*:* Versions 9.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp1:*:*:*:*:*:* Versions 9.1 sp1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp10:*:*:*:*:*:* Versions 9.1 sp10 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp11:*:*:*:*:*:* Versions 9.1 sp11 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp12:*:*:*:*:*:* Versions 9.1 sp12 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp3:*:*:*:*:*:* Versions 9.1 sp3 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp4:*:*:*:*:*:* Versions 9.1 sp4 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp5:*:*:*:*:*:* Versions 9.1 sp5 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp6:*:*:*:*:*:* Versions 9.1 sp6 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp7:*:*:*:*:*:* Versions 9.1 sp7 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp8:*:*:*:*:*:* Versions 9.1 sp8 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:ip_office:9.1:sp9:*:*:*:*:*:* Versions 9.1 sp9 Vulnerable ·Avaya

Remediation

  • Fix · CNA IP Office (Avaya) Fixed in 10.1.0.8, 11.0.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7030
  2. 2026-10-03 Alias added: GHSA-jv7q-mm3q-m55p

References

Advisory 1

Other 2

  • TI-2017-08352 Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote… CVSS 3.0CRITICAL 9.6
  • TI-2024-03903 Avaya IP Office Web Control RCE Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-03904 Avaya IP Office One-X Portal File Upload Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2018-11135 Improper access controls in IP Office one-X Portal CVSS 3.0HIGH 8.8
  • TI-2016-04582 NULL pointer dereference in Mozilla Network Security Services CVSS 3.1HIGH 7.5
  • TI-2019-04935 Unauthenticated Information Disclosure Vulnerability in IP Office CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences