Mitel · MiCollab
CVE-2024-41713
Mitel MiCollab Path Traversal Vulnerability
Nedir
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CISA: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 28 Ocak 2025
Mitel için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 7 Oca 2025 | Path Traversal | MiCollab | Orta 4,4 | 38% |
| 12 Şub 2025 | Argument Injection | SIP Phones | Orta 6,8 | 42% |
| 21 Şub 2023 | Command Injection | MiVoice Connect | Orta 6,8 | 11% |
| 21 Şub 2023 | Code Injection | MiVoice Connect | Orta 6,8 | 11% |
| 27 Haz 2022 | Data Validation | MiVoice Connect | Kritik 9,8 | 55% |
| 25 Mar 2022 | Access Control | MiCollab, MiVoice Business Express | Kritik 9,8 | 87% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.