CVE-2021-25655: URL redirection to untrusted site possible in Avaya Aura Experience Portal

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-24 · updated 2026-06-17
Weakness: CWE-601

Description

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).

Affected products

Avaya Experience Portal Manager: from 7.0 through 7.2.3; 8.0.0

References

https://downloads.avaya.com/css/P8/documents/101076234
https://downloads.avaya.com/css/P8/documents/101076234

Get alerted when CVE-2021-25655 or the next vulnerability affects your stack