title: Avaya Aura Experience Portal XSS vulnerabilities
description: Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
affected:
{
product: Product
vendor: Avaya
versions:
status: affected, version: 8.0
lessThan: 7.0*, status: affected, version: 7.2.3, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]