Avaya Aura Conferencing XSS
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potentially disclose sensitive information. Affected versions of Avaya Aura Conferencing include all 8.x versions prior to 8.0 SP14 (8.0.14). Prior versions not listed were not evaluated.
Why it matters now
EPSS 0.01075 65th percentileScored 2026-11-07
Fix Fixed Avaya Aura Conferencing (Avaya): 8.0.14
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Avaya | Avaya Aura Conferencing | 8.x to before 8.0.14 | 8.0.14 | Patch available | CNA |
- Avaya Aura Conferencing VendorAvaya Affected 8.x to before 8.0.14 Fixed in 8.0.14 Patch available CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:avaya:aura_conferencing:*:*:*:*:*:*:*:* | up to 8.0 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:-:*:*:*:*:*:* | 8.0 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp10:*:*:*:*:*:* | 8.0 sp10 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp11:*:*:*:*:*:* | 8.0 sp11 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp12:*:*:*:*:*:* | 8.0 sp12 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp13:*:*:*:*:*:* | 8.0 sp13 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp2:*:*:*:*:*:* | 8.0 sp2 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp4:*:*:*:*:*:* | 8.0 sp4 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp5:*:*:*:*:*:* | 8.0 sp5 | Vulnerable | Avaya |
| cpe:2.3:a:avaya:aura_conferencing:8.0:sp7:*:*:*:*:*:* | 8.0 sp7 | Vulnerable | Avaya |
- cpe:2.3:a:avaya:aura_conferencing:*:*:*:*:*:*:*:* Versions up to 8.0 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:-:*:*:*:*:*:* Versions 8.0 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp10:*:*:*:*:*:* Versions 8.0 sp10 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp11:*:*:*:*:*:* Versions 8.0 sp11 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp12:*:*:*:*:*:* Versions 8.0 sp12 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp13:*:*:*:*:*:* Versions 8.0 sp13 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp2:*:*:*:*:*:* Versions 8.0 sp2 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp4:*:*:*:*:*:* Versions 8.0 sp4 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp5:*:*:*:*:*:* Versions 8.0 sp5 Vulnerable ·Avaya
- cpe:2.3:a:avaya:aura_conferencing:8.0:sp7:*:*:*:*:*:* Versions 8.0 sp7 Vulnerable ·Avaya
Remediation
- Fix · CNA Avaya Aura Conferencing (Avaya) Fixed in 8.0.14
Timeline
- 2026-10-02 Threatist record created from CVE-2019-7000
- 2026-10-03 Alias added: GHSA-cjw9-j68c-hvw7
References
More Avaya Aura Conferencing vulnerabilities
- TI-2019-04937 Avaya Equinox Conferencing Management (iView) Directory Traversal Vulnerability CVSS 3.1HIGH 8.6
- TI-2016-04582 NULL pointer dereference in Mozilla Network Security Services CVSS 3.1HIGH 7.5
Sources
- CVE-2019-7000 · CVE Program
- CVE-2019-7000 · NVD
- FIRST EPSS
- GHSA-cjw9-j68c-hvw7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences