Medium severity · published Sep 21, 2018
CVE-2018-15613
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Aura Orchestration Designer · Avaya
before 7.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-15613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-15613
Patch
https://downloads.avaya.com/css/P8/documents/101052293
More from Aura Orchestration Designer
6.5
CVE-2020-7035
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access…