CVE-2019-7004 Avaya IP Office XSS Vulnerability

2019-12-1100:00:00

CWE-79

avaya

www.cve.org

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

0.002 Low

EPSS

Percentile

64.7%

JSON

A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.

CNA Affected

[
  {
    "product": "IP Office Application Server ",
    "vendor": "Avaya",
    "versions": [
      {
        "lessThanOrEqual": "11.0 FP4 SP1",
        "status": "affected",
        "version": "11.x",
        "versionType": "custom"
      }
    ]
  }
]