CVE-2020-7032 - Vulnerability Details - OpenCVE

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Avaya	Aura System Manager Weblm

Configuration 1 [-]

OR	cpe:2.3:a:avaya:aura_system_manager::::::::
	cpe:2.3:a:avaya:aura_system_manager::::::::
	cpe:2.3:a:avaya:weblm::::::::
	cpe:2.3:a:avaya:weblm::::::::

No data.

References

Link	Providers
http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html
http://seclists.org/fulldisclosure/2020/Nov/31
https://downloads.avaya.com/css/P8/documents/101072249
https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/

History

No history.

MITRE

Status: PUBLISHED

Assigner: avaya

Published: 2020-11-13T00:20:14.764716Z

Updated: 2024-09-17T01:45:48.139Z

Reserved: 2020-01-14T00:00:00

Link: CVE-2020-7032

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-11-13T01:15:11.917

Modified: 2024-11-21T05:36:31.117

Link: CVE-2020-7032

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "WebLM", "vendor": "Avaya", "versions": [{"status": "affected", "version": "8.0.x"}, {"lessThan": "7.1.3.6", "status": "affected", "version": "7.0", "versionType": "custom"}, {"lessThan": "8.1.2", "status": "affected", "version": "8.1", "versionType": "custom"}]}, {"product": "System Manager", "vendor": "Avaya", "versions": [{"status": "affected", "version": "8.0.x"}, {"lessThan": "7.1.3.6", "status": "affected", "version": "7.0", "versionType": "custom"}, {"lessThan": "8.1.2", "status": "affected", "version": "8.1", "versionType": "custom"}]}], "datePublic": "2020-11-12T00:00:00", "descriptions": [{"lang": "en", "value": "An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611: Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-12T20:54:07", "orgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "shortName": "avaya"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://downloads.avaya.com/css/P8/documents/101072249"}, {"name": "20201117 SEC Consult SA-20201117-0 :: Blind Out-Of-Band XML External Entity Injection in Avaya Web License Manager", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2020/Nov/31"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html"}, {"tags": ["x_refsource_MISC"], "url": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/"}], "source": {"advisory": "ASA-2020-153"}, "title": "Avaya WebLM Improper Restriction of XML External Entity Reference", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "securityalerts@avaya.com", "DATE_PUBLIC": "2020-11-12T07:00:00.000Z", "ID": "CVE-2020-7032", "STATE": "PUBLIC", "TITLE": "Avaya WebLM Improper Restriction of XML External Entity Reference"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WebLM", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "7.0", "version_value": "7.1.3.6"}, {"affected": "=", "version_affected": "=", "version_name": "8.0.x", "version_value": "8.0.x"}, {"affected": "<", "version_affected": "<", "version_name": "8.1", "version_value": "8.1.2"}]}}, {"product_name": "System Manager", "version": {"version_data": [{"affected": "<", "version_affected": "<", "version_name": "7.0", "version_value": "7.1.3.6"}, {"affected": "=", "version_affected": "=", "version_name": "8.0.x", "version_value": "8.0.x"}, {"affected": "<", "version_affected": "<", "version_name": "8.1", "version_value": "8.1.2"}]}}]}, "vendor_name": "Avaya"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-611: Improper Restriction of XML External Entity Reference"}]}]}, "references": {"reference_data": [{"name": "https://downloads.avaya.com/css/P8/documents/101072249", "refsource": "CONFIRM", "url": "https://downloads.avaya.com/css/P8/documents/101072249"}, {"name": "20201117 SEC Consult SA-20201117-0 :: Blind Out-Of-Band XML External Entity Injection in Avaya Web License Manager", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Nov/31"}, {"name": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html"}, {"name": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/", "refsource": "MISC", "url": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/"}]}, "source": {"advisory": "ASA-2020-153"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:18:02.523Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://downloads.avaya.com/css/P8/documents/101072249"}, {"name": "20201117 SEC Consult SA-20201117-0 :: Blind Out-Of-Band XML External Entity Injection in Avaya Web License Manager", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2020/Nov/31"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/"}]}]}, "cveMetadata": {"assignerOrgId": "9d670455-bdb5-4cca-a883-5914865f5d96", "assignerShortName": "avaya", "cveId": "CVE-2020-7032", "datePublished": "2020-11-13T00:20:14.764716Z", "dateReserved": "2020-01-14T00:00:00", "dateUpdated": "2024-09-17T01:45:48.139Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:avaya:aura_system_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "21B18730-A7F9-4857-A3B8-89BA90EB8D03", "versionEndIncluding": "7.1.3.6", "versionStartIncluding": "7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:avaya:aura_system_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "677058A7-D285-4935-9C4D-1819A65384D9", "versionEndIncluding": "8.1.2", "versionStartIncluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:avaya:weblm:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3D62170-8860-4BE3-85F4-8E96AD2AC10B", "versionEndIncluding": "7.1.3.6", "versionStartIncluding": "7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:avaya:weblm:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AE0ED15-0CF5-41F5-91DA-17464A86DCE7", "versionEndExcluding": "8.1.3", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2."}, {"lang": "es", "value": "Una vulnerabilidad de tipo XML external entity (XXE) en la interfaz de administraci\u00f3n de Avaya WebLM, permite a usuarios autenticados leer archivos arbitrarios o realizar ataques de tipo server-side request forgery (SSRF) por medio de un DTD dise\u00f1ado en una petici\u00f3n XML. Las versiones afectadas de Avaya WebLM incluyen: versiones 7.0 hasta 7.1.3.6 y versiones 8.0 hasta 8.1.2"}], "id": "CVE-2020-7032", "lastModified": "2024-11-21T05:36:31.117", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "securityalerts@avaya.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-13T01:15:11.917", "references": [{"source": "securityalerts@avaya.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html"}, {"source": "securityalerts@avaya.com", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2020/Nov/31"}, {"source": "securityalerts@avaya.com", "tags": ["Vendor Advisory"], "url": "https://downloads.avaya.com/css/P8/documents/101072249"}, {"source": "securityalerts@avaya.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2020/Nov/31"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://downloads.avaya.com/css/P8/documents/101072249"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/"}], "sourceIdentifier": "securityalerts@avaya.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "securityalerts@avaya.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}