Medium severity · published Apr 23, 2021
CVE-2020-7035
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access…
6.5
CVSS
1.1%
EPSS
No
On KEV
Description
An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AO
Aura Orchestration Designer · Avaya
7.0 through 7.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7035
Vendor Advisory
https://downloads.avaya.com/css/P8/documents/101075450
More from Aura Orchestration Designer
6.1
CVE-2018-15613
A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user