CVE-2024-12756

CVE-2024-12756 is an HTML Injection vulnerability in Avaya Spaces that may allow disclosure of sensitive information or modification of the page content seen by the user. Published on 2025-02-11, it is linked to CWE-1287 (Improper Validation of Specified Index or Position) and CWE-79 (Cross-site Scripting). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N), indicating high severity with network vector, high attack complexity, privileged access requirements, user interaction, changed scope, high confidentiality and integrity impacts, and no availability impact.

Exploitation requires an attacker with high privileges (PR:H) to have network access (AV:N), perform a high-complexity attack (AC:H), and induce user interaction (UI:R). A successful attack could enable the privileged attacker to disclose sensitive information or modify page content viewed by targeted users, leveraging the changed scope (S:C) for high confidentiality (C:H) and integrity (I:H) effects.

The Avaya advisory provides details on mitigation, available at https://support.avaya.com/css/public/documents/101091836.