Lucene search

AvayaCVELIST:CVE-2020-7035

HistoryApr 23, 2021 - 9:00 p.m.

CVE-2020-7035 XXE in Avaya Aura Orchestration Designer

2021-04-2321:00:20

CWE-611

avaya

www.cve.org

cve-2020-7035

xml external entities

avaya aura orchestration designer

web-based interface

authenticated remote attacker

read access

affected system

orchestration designer

version 7.x

7.2.3

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

49.0%

JSON

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

CNA Affected

[
  {
    "product": "Aura Orchestration Designer",
    "vendor": "Avaya",
    "versions": [
      {
        "lessThan": "7.2.3",
        "status": "affected",
        "version": "7.x",
        "versionType": "custom"
      }
    ]
  }
]

References

downloads.avaya.com/css/P8/documents/101075450

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

49.0%

JSON

Related for CVELIST:CVE-2020-7035