CVE-2024-12756

High

Published: 11 February 2025

Published

11 February 2025

Modified

01 October 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N

EPSS Score 0.0005 16.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-12756 is a high-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Avaya Spaces. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2024-12756 is an HTML Injection vulnerability in Avaya Spaces that may allow disclosure of sensitive information or modification of the page content seen by the user. Published on 2025-02-11, it is linked to CWE-1287 (Improper Validation of Specified Index or Position) and CWE-79 (Cross-site Scripting). The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N), indicating high severity with network vector, high attack complexity, privileged access requirements, user interaction, changed scope, high confidentiality and integrity impacts, and no availability impact.

Exploitation requires an attacker with high privileges (PR:H) to have network access (AV:N), perform a high-complexity attack (AC:H), and induce user interaction (UI:R). A successful attack could enable the privileged attacker to disclose sensitive information or modify page content viewed by targeted users, leveraging the changed scope (S:C) for high confidentiality (C:H) and integrity (I:H) effects.

The Avaya advisory provides details on mitigation, available at https://support.avaya.com/css/public/documents/101091836.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-51091

Vulnerability details

An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.

CWE(s): CWE-1287 CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1189 Drive-by Compromise Initial Access

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

attack.mitre.org →

Why these techniques?

HTML injection/XSS in a web application (Avaya Spaces) directly enables exploitation of public-facing apps (T1190) and can facilitate drive-by compromise by injecting malicious client-side content/scripts visible to users (T1189).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1