| Doc ID |
|
SOLN386770 |
| Version: |
|
1.0 |
| Status: |
|
Published |
| Published date: |
|
10 Jul 2026 |
Details
Customer IPO release is 12.x
Information Disclosure on https:///nasystem/user_list5 https:///nasystem/scn_user_list. It exposes the user information including email address, full name and extension.
Problem Clarification
Information Disclosure on https://<ipo-dns-ip>/nasystem/user_list5 https://<ipo-dns-ip>/nasystem/scn_user_list.
Cause
IPO Security config.
Solution
There are 2 ways to address this issue. One way is to disable the TFTP Directory Read option in the Security Settings under Unsecured Interfaces. However, if you have 3rd party applications like Avaya Call Reporting (XIma Chronicall) or similar applications or DECT phones, they will be impacted. Another way is to enable the checkbox Avaya HTTP Clients Only in IP Office configuration under System. By enabling this feature, only Avaya endpoints including IX Workplace can access those files on the IPO server including the 46xxsettings.txt file.
You must apply either of the two options above to the Primary, Secondary and Expansion Systems.
The solutions mentioned above do not require a system restart.
