CVE-2019-7004
Avaya IP Office XSS Vulnerability
- State
- Published
- Severity
- 6.4 Medium
- Published
- Dec 11, 2019
- Updated
- Sep 17, 2024
- Reserved
- Jan 28, 2019
Description
A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.4 Medium | CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N | avaya |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
IP Office Application ServerAvaya |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.