Path Traversal Vulnerability in Mitel MiCollab Enables Data Breach
A weakness is found in the NuPoint Unified Messaging part of Mitel MiCollab up to version 9.8 SP1 FP2 (9.8.1.201). This flaw could let an attacker, without logging in, perform a path traversal attack. The problem is caused by poor input checks. If exploited, it could give the attacker access to view, change, or erase user data and system settings.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mitel micollab - |
||
mitel micollab |
CISA warns of critical Oracle, Mitel flaws exploited in attacks By Sergiu Gatlan January 7, 2025 01:45 PM 0 CISA has warned U.S. federal agencies to secure their systems against critical vulnerabilities in Oracle WebLogic Server and Mitel MiCollab systems that are actively exploited in attacks. The cybersecurity agency added a critical path traversal vulnerability (CVE-2024-41713) found in the NuPoint Unified Messaging (NPM) component Mitel's MiCollab unified communications platform to its Known...
Mitel MiCollab zero-day flaw gets proof-of-concept exploit By Bill Toulas December 5, 2024 06:00 AM 0 Researchers have uncovered an arbitrary file read zero-day in the Mitel MiCollab collaboration platform, allowing attackers to access files on a server's filesystem. Mitel MiCollab is an enterprise collaboration platform that consolidates various communication tools into a single application, offering voice and video calling, messaging, presence information, audio conferencing, mobility support,...
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources 3 CVEs added to CISA's catalog
Cybercriminals are actively exploiting two vulnerabilities in Mitel MiCollab, including a zero-day flaw – and a critical remote code execution vulnerability in Oracle WebLogic Server that has been abused for at least five years. Here are the three, all of which the US Cybersecurity and Infrastructure Security Agency (CISA) added to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: Two of the three – Mitel's CVE-2024-41713, and Oracle's CVE-2020-2883 – ha...
Topics Security Off-Prem On-Prem Software Offbeat Special Features Vendor Voice Vendor Voice Resources Still unpatched 100+ days later, watchTowr says
A zero-day arbitrary file read vulnerability in Mitel MiCollab can be chained with a now-patched critical bug in the same platform to give attackers access to sensitive files on vulnerable instances. A proof-of-concept (PoC) exploit that strings together the two flaws, both spotted and disclosed to Mitel by watchTowr, which on Thursday published the PoC after waiting 100-plus days for the vendor to issue a fix. The Register has reached out to Mitel for comment and did not immediately recei...
Vulmon