CVE-2020-7035

XXE in Avaya Aura Orchestration Designer

State: Published
Severity: 8.1 High
Published: Apr 23, 2021
Updated: Sep 16, 2024
Reserved: Jan 14, 2020

Description

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	avaya

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
Aura Orchestration DesignerAvaya	7.x to before 7.2.3Affected

References

https://downloads.avaya.com/css/P8/documents/101075450

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.