Read the docs
TI-2020-05676 Aliases CVE-2020-7036GHSA-64f2-mh2m-9cj7

XXE in Avaya Callback Assist Administration

Priority LOW 37CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7.

Why it matters now

EPSS 0.00981 62nd percentileScored 2026-11-07
Fix Fixed Callback Assist (Avaya): 4.7.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvayaCallback Assist4.0.x to before 4.7.1.14.7.1.1Patch availableCNA
  • Callback Assist VendorAvaya Affected 4.0.x to before 4.7.1.1 Fixed in 4.7.1.1 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:avaya:callback_assist:*:*:*:*:*:*:*:*4.0.0 to before 4.7.1.1VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:-:*:*:*:*:*:*4.7.1.1VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch1:*:*:*:*:*:*4.7.1.1 patch1VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch2:*:*:*:*:*:*4.7.1.1 patch2VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch3:*:*:*:*:*:*4.7.1.1 patch3VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch4:*:*:*:*:*:*4.7.1.1 patch4VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch5:*:*:*:*:*:*4.7.1.1 patch5VulnerableAvaya
cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch6:*:*:*:*:*:*4.7.1.1 patch6VulnerableAvaya
  • cpe:2.3:a:avaya:callback_assist:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.7.1.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:-:*:*:*:*:*:* Versions 4.7.1.1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch1:*:*:*:*:*:* Versions 4.7.1.1 patch1 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch2:*:*:*:*:*:* Versions 4.7.1.1 patch2 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch3:*:*:*:*:*:* Versions 4.7.1.1 patch3 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch4:*:*:*:*:*:* Versions 4.7.1.1 patch4 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch5:*:*:*:*:*:* Versions 4.7.1.1 patch5 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:callback_assist:4.7.1.1:patch6:*:*:*:*:*:* Versions 4.7.1.1 patch6 Vulnerable ·Avaya

Remediation

  • Fix · CNA Callback Assist (Avaya) Fixed in 4.7.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7036
  2. 2026-10-03 Alias added: GHSA-64f2-mh2m-9cj7

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences