{"cve":"CVE-2008-6707","nvd":{"published":"2009-04-10T22:00:00.670","modified":"2026-06-16T23:02:48.860","status":"Modified","description":"The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not perform authentication for certain functionality, which allows remote attackers to obtain sensitive information and access restricted functionality via (1) the certificate installation utility, (2) unspecified scripts in the objects folder, (3) an \"unnecessary default application,\" (4) unspecified scripts in the states folder, (5) an unspecified \"default application\" that lists server configuration, and (6) \"full system help.\"","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-287"],"references":["http://osvdb.org/46598","http://osvdb.org/46599","http://osvdb.org/46600","http://secunia.com/advisories/30751","http://support.avaya.com/elmodocs2/security/ASA-2008-268.htm"],"products":["avaya:communication_manager","avaya:sip_enablement_services"],"source":"nvd","synced_at":"2026-10-19T19:54:07.895733559+00:00"},"epss":{"cve":"CVE-2008-6707","score":0.01498,"percentile":0.74239,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}