CVE-2020-7037

Published: Apr 28, 2021Modified: Nov 21, 2024

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server.

Affected (1)

Products: Avaya: Equinox Conferencing

1 product

Equinox Conferencing

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Avaya Equinox Conferencing	From 9.0.0 to 9.1.11

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://support.avaya.com/css/P8/documents/101075574

Source: securityalerts@avaya.com

Vendor Advisory

https://support.avaya.com/css/P8/documents/101075574

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.