Mitel · MiCollab
CVE-2024-41713
Mitel MiCollab Path Traversal Vulnerability
무엇인가
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CISA: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
할 일
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2025년 1월 28일
Mitel의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2025. 1. 7. | Path Traversal | MiCollab | 보통 4.4 | 38% |
| 2025. 2. 12. | Argument Injection | SIP Phones | 보통 6.8 | 42% |
| 2023. 2. 21. | Command Injection | MiVoice Connect | 보통 6.8 | 11% |
| 2023. 2. 21. | Code Injection | MiVoice Connect | 보통 6.8 | 11% |
| 2022. 6. 27. | Data Validation | MiVoice Connect | 치명적 9.8 | 55% |
| 2022. 3. 25. | Access Control | MiCollab, MiVoice Business Express | 치명적 9.8 | 87% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.