What’s Vulnerable › Vulnerabilities

CVE-2020-7035: XXE in Avaya Aura Orchestration Designer

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-23 · updated 2026-06-17
• Weakness: CWE-611

Description

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

Affected products

• Avaya Aura Orchestration Designer: from 7.0 through 7.2.2

References

• https://downloads.avaya.com/css/P8/documents/101075450
• https://downloads.avaya.com/css/P8/documents/101075450

Get alerted when CVE-2020-7035 or the next vulnerability affects your stack