PT-2020-19348 · Avaya · Avaya Weblm

M. Koplin · CVE-2020-7032 · Published 2020-11-13 · Updated 2022-10-19

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Avaya WebLM versions 7.0 through 7.1.3.6 Avaya WebLM versions 8.0 through 8.1.2

Description An XML external entity (XXE) vulnerability in the Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Recommendations For Avaya WebLM versions 7.0 through 7.1.3.6, update to a version later than 7.1.3.6 to resolve the issue. For Avaya WebLM versions 8.0 through 8.1.2, update to a version later than 8.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the admin interface to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-7032

Affected Products

Avaya Weblm

References · 9

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Nov/31 · Exploit
• 🔥 http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-7032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7032 · Security Note
• https://downloads.avaya.com/css/P8/documents/101072249 · Vendor Advisory
• https://t.me/cvenotify/5753 · Telegram Post
• https://t.me/cybersecuritytechnologies/2128 · Telegram Post
• https://t.me/cibsecurity/16282 · Telegram Post