CVE-2020-7035 - XXE in Avaya Aura Orchestration Designer

Back Back to CVE browser

HIGH

XXE in Avaya Aura Orchestration Designer

Published Apr 23, 2021

8.1

HIGH

CVSS 3.1

EPSS 1.07%

Description

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

Affected products

Vendor Avaya Product Aura Orchestration Designer Default
n/a
- Version
  7.x
  Status
  affected
  Constraints
  <7.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Avaya

Aura Orchestration Designer

n/a

Version	Status	Constraints
7.x	affected	<7.2.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://downloads.avaya.com/css/P8/documents/101075450
x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28169
Advisory

Link	Providers	Tags
https://downloads.avaya.com/css/P8/documents/101075450		x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28169		Advisory