CVE-2024-35287

Oct. 23, 2024, 3:12 p.m.

6.7
Medium

Description

A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.

Product(s) Impacted

Product Versions
Mitel MiCollab NuPoint Messenger
  • through 9.8 SP1 (9.8.1.5)

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0023

Tags

cve@mitre.org
CWE-276
2024-10-21
CVE-2024-35287

CVSS Score

6.7 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

    View Vector String

Timeline

Published: Oct. 21, 2024, 9:15 p.m.
Last Modified: Oct. 23, 2024, 3:12 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.