CVE-2019-7004CWE-79

Avaya IP Office XSS Vulnerability

Medium · published December 11, 2019

CVSS v3.0
6.4
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02183 · 82.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2019-12-11T23:25Z
EPSS history
Timeline
  • 11 DEC 23:25Z
    Avaya IP Office XSS Vulnerability
    cvelistv5