CVE-2020-7032

🗓️ 13 Nov 2020 01:15:11Reported by [email protected]Type

An XML external entity (XXE) vulnerability in Avaya WebLM allows authenticated users to read files or conduct SSRF attacks via a crafted DTD in an XML request. Affected versions: 7.0-7.1.3.6, 8.0-8.1.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2020-7032	13 Nov 202007:32	–	circl
CVE	CVE-2020-7032	13 Nov 202000:20	–	cve
Cvelist	CVE-2020-7032 Avaya WebLM Improper Restriction of XML External Entity Reference	13 Nov 202000:20	–	cvelist
EUVD	EUVD-2020-28166	7 Oct 202500:30	–	euvd
OSV	CVE-2020-7032	13 Nov 202001:15	–	osv
Packet Storm	Avaya Web License Manager XML Injection	18 Nov 202000:00	–	packetstorm
Prion	Server side request forgery (ssrf)	13 Nov 202001:15	–	prion
Positive Technologies	PT-2020-19348 · Avaya · Avaya Weblm	13 Nov 202000:00	–	ptsecurity

NVD

Node

avaya aura_system_managerRange7.0–7.1.3.6

avaya aura_system_managerRange8.0–8.1.2

avaya weblmRange7.0–7.1.3.6

avaya weblmRange8.0.0–8.1.3

Source	Link
seclists	www.seclists.org/fulldisclosure/2020/Nov/31
sec-consult	www.sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/
downloads	www.downloads.avaya.com/css/P8/documents/101072249
packetstormsecurity	www.packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html

21 Nov 2024 05:36Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25.5

CVSS 3.16.5

EPSS0.00429

CWE-611