CVE-2019-7004: Avaya IP Office XSS Vulnerability

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-12 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, including unsupported versions, were not evaluated.

Affected products

Avaya IP Office Application Server: from 11.0 through 11.0.4.0

References

http://packetstormsecurity.com/files/156476/Avaya-IP-Office-Application-Server-11.0.0.0-Cross-Site-Scripting.html
https://support.avaya.com/css/P8/documents/101062833
http://packetstormsecurity.com/files/156476/Avaya-IP-Office-Application-Server-11.0.0.0-Cross-Site-Scripting.html
https://support.avaya.com/css/P8/documents/101062833

Get alerted when CVE-2019-7004 or the next vulnerability affects your stack