PT-2021-16732 · Avaya · Avaya Aura Experience Portal

Hieu Tran · Published 2021-06-24 · Updated 2021-06-30 · CVE-2021-25655

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avaya Aura Experience Portal versions 7.0 through 7.2.3 Avaya Aura Experience Portal version 8.0.0

Description A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack.

Recommendations For Avaya Aura Experience Portal versions 7.0 through 7.2.3, apply the hotfix to resolve the issue. For Avaya Aura Experience Portal version 8.0.0, apply the hotfix to resolve the issue.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-25655

Affected Products

Avaya Aura Experience Portal

References · 4

• https://downloads.avaya.com/css/P8/documents/101076234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25655 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25655 · Vendor Advisory
• https://t.me/cibsecurity/25667 · Telegram Post