{"id":"CVE-2021-25656","aliases":["EUVD-2021-12548","GHSA-7cpc-3c6p-38qh"],"status":"published","title":"Avaya Aura Experience Portal XSS vulnerabilities","description":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00342,"percentile":0.27874,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-06-24T08:55:32Z","modified":"2026-06-17T03:42:17Z","products":[{"vendor":"avaya","product":"aura_experience_portal"},{"vendor":"avaya","product":"product"}],"references":[{"url":"https://downloads.avaya.com/css/P8/documents/101076234","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25656"},{"url":"https://github.com/advisories/GHSA-7cpc-3c6p-38qh"}],"sources":{"cve":[{"id":"CVE-2021-25656","title":"Avaya Aura Experience Portal XSS vulnerabilities","description":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).","status":"published","published":"2021-06-24T08:55:32Z","modified":"2024-08-03T20:11:28.258Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-12548","description":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).","status":"published","published":"2021-06-24T08:55:32Z","modified":"2024-08-03T20:11:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:24:52.420769Z"}],"ghsa":[{"id":"GHSA-7cpc-3c6p-38qh","title":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web...","description":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).","status":"published","published":"2022-05-24T19:06:03Z","modified":"2023-01-29T05:07:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:09.170985Z"}],"nvd":[{"id":"CVE-2021-25656","description":"Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).","status":"published","published":"2021-06-24T09:15:11.063Z","modified":"2026-06-17T03:42:17.613Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:54.892562Z"}]}}