TI-2020-05675 Aliases CVE-2020-7035 GHSA-89x6-9566-cfcx

XXE in Avaya Aura Orchestration Designer

LOW 37CWE-611Published 2021-04-23 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3.

Why it matters now

EPSS 0.01067 64th percentileScored 2026-11-07

Fix Fixed Aura Orchestration Designer (Avaya): 7.2.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Avaya	Aura Orchestration Designer	7.x to before 7.2.3	7.2.3	Patch available	CNA

Aura Orchestration Designer VendorAvaya Affected 7.x to before 7.2.3 Fixed in 7.2.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:avaya:aura_orchestration_designer::::::::	7.0 – 7.2.2	Vulnerable	Avaya

cpe:2.3:a:avaya:aura_orchestration_designer:*:*:*:*:*:*:*:* Versions 7.0 – 7.2.2 Vulnerable ·Avaya

Remediation

Fix · CNA Aura Orchestration Designer (Avaya) Fixed in 7.2.3

Timeline

2026-10-02 Threatist record created from CVE-2020-7035
2026-10-03 Alias added: GHSA-89x6-9566-cfcx

References

Advisory 1

https://downloads.avaya.com/css/P8/documents/101075450

TI-2018-11138 Orchestration Designer Runtime Config XSS CVSS 3.0HIGH 8.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences