CVE-2021-25655

CWE-601 — Open Redirect3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.1%
top 69.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Avaya Avaya Experience PortalAvaya Aura Experience Portal
Timeline
PublishedJun 24
Latest updateMay 24

Description

A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted attack. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LExploitability: 1.8 | Impact: 2.5

Affected Packages2 packages

▶NVDavaya/aura_experience_portal7.0 — 7.2.3+1
▶CVEListV5avaya/avaya_experience_portal7.2.3 — 7.0*+1

Patches

Patch: downloads.avaya.com ↗Patch: downloads.avaya.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-hcwx-phqf-jfmw: A vulnerability in the system Service Menu component of Avaya Aura Experience Portal may allow URL Redirection to any untrusted site through a crafted↗2022-05-24
▶
CVEList
URL redirection to untrusted site possible in Avaya Aura Experience Portal↗2021-06-24
▶