Avaya Aura Experience Portal vulnerabilities

4 CVEs affecting Avaya Aura Experience Portal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-7031, published 2024-01-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5285, published 2019-11-15. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote…
CVE-2021-25655, published 2021-06-24. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through…
CVE-2021-25656, published 2021-06-24. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected…
CVE-2023-7031, published 2024-01-17. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user.…