PT-2021-16733 · Avaya · Avaya Aura Experience Portal Web Management

Hieu Tran · Published 2021-06-24 · Updated 2021-06-30 · CVE-2021-25656

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Avaya Aura Experience Portal Web management versions 7.0 through 7.2.3 Avaya Aura Experience Portal Web management version 8.0.0

Description Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management, which could allow an authenticated user to potentially disclose sensitive information.

Recommendations For Avaya Aura Experience Portal Web management versions 7.0 through 7.2.3, apply the necessary hotfix to resolve the issue. For Avaya Aura Experience Portal Web management version 8.0.0, apply the necessary hotfix to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25656

Affected Products

Avaya Aura Experience Portal Web Management

References · 4

• https://downloads.avaya.com/css/P8/documents/101076234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25656 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25656 · Vendor Advisory
• https://t.me/cvenotify/16916 · Telegram Post