Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-7000: Avaya Aura Conferencing web UI can run malicious code

CVE-2019-7000 · published 7 years ago

Summary

The web interface of Avaya Aura Conferencing (versions 8.x before 8.0 SP14) can be tricked into executing unwanted scripts. An attacker could use this to view or steal sensitive information. Update to the latest service pack or apply the vendor's recommended fix as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
avaya	aura_conferencing	<= 8.0 8.0 `cpe:2.3:a:avaya:aura_conferencing::::::::`

Original advisory text

A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated.

References

https://downloads.avaya.com/css/P8/documents/101060208 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published31 Jul 2019

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-7000 · NVD

Track software like this

Free during beta