← Vulnerability feed

Vulnerability record · CVE-2020-7032 · published 13 November 2020

CVE-2020-7032: Avaya aura system manager xml external entity (xxe) vulnerability

Avaya · Aura System Manager

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

6.5 CVSS 3.1 Medium EPSS 2.9% · top 13.6% CWE-611 · XML external entity (XXE)
6.5CVSS 3.1 base score, v2 5.5
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Nov/31 ExploitMailing ListThird Party Advisory
https://downloads.avaya.com/css/P8/documents/101072249 Vendor Advisory
https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license- ExploitThird Party Advisory
http://packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Nov/31 ExploitMailing ListThird Party Advisory
https://downloads.avaya.com/css/P8/documents/101072249 Vendor Advisory
https://sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license- ExploitThird Party Advisory

Track CVE-2020-7032 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2010-2943Linux kernel information exposure vulnerabilityThe xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote a…EPSS 17%7.8CVE-2010-2492Linux kernel classic buffer overflow vulnerabilityBuffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow loc…EPSS 0.43%7.8CVE-2010-2798Linux kernel null pointer dereference vulnerabilityThe gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with s…EPSS 0.41%7.5CVE-2016-5285Mozilla nss null pointer dereference vulnerabilityA Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_Comput…EPSS 2.3%7.1CVE-2009-3939Linux kernel incorrect permission assignment vulnerabilityThe poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users t…EPSS 0.44%6.7CVE-2024-7477Avaya aura system manager sql injection vulnerabilityA SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbitrary que…EPSS 0.19%5.5CVE-2010-2942Linux kernel memory leak vulnerabilityThe actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure…EPSS 0.42%4.4CVE-2024-7480Avaya aura system manager vulnerabilityAn Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administra…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2020-7032), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.