PT-2021-12639 · Avaya · Avaya Equinox Conferencing

Alex Joss + 1 · Published 2021-04-28 · Updated 2021-05-07 · CVE-2020-7037

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Avaya Equinox Conferencing versions 9.x through 9.1.10

Description: An XML External Entities (XXE) issue in the Media Server component could allow an authenticated, remote attacker to gain read access to information stored on an affected system or potentially lead to a denial of service.

Recommendations: For Avaya Equinox Conferencing versions 9.x through 9.1.10, update to version 9.1.11 or later to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2020-7037

Affected Products

Avaya Equinox Conferencing

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-7037 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7037 · Vendor Advisory
• https://support.avaya.com/css/P8/documents/101075574 · Vendor Advisory
• https://t.me/cvenotify/13897 · Telegram Post
• https://t.me/cvenotify/14206 · Telegram Post