by Kastro
Paper/Archive/CVE-2024-47223

CVE-2024-47223

mitel micollab — A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an…

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
36
CVSS 9.4 (ADP)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 41.2.412 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
micollab< 9.8.2.129.8.2.12CISA-ADP

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refmitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0028