Medium severity · published Nov 13, 2020
CVE-2020-7033
A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Equinox Conferencing · Avaya
9.0.0 before 9.1.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7033
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7033
Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101072147
More from Equinox Conferencing
8.1
CVE-2020-7037
An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to…
7.5
CVE-2020-7038
A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an unauthenticated, remote attacker to gain access to screen…