CVE-2020-7032CWE-611

Avaya WebLM Improper Restriction of XML External Entity Reference

Medium · published November 13, 2020

CVSS v3.1
6.5
EPSS
3%
Percentile
86.8
In the wild
Unconfirmed
What it is

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02895 · 86.8th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2020-11-13T00:20Z
EPSS history
Timeline
  • 13 NOV 00:20Z
    Avaya WebLM Improper Restriction of XML External Entity Reference
    cvelistv5