SecuriTricks - CVE-2024-55550

Description

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

Product(s) Impacted

Vendor	Product	Versions
Mitel	Micollab	*, 9.8

Weaknesses

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

*CPE(s)

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	mitel	micollab	/	/	/	/	/	-	/	/
a	mitel	micollab	9.8	-	/	/	/	-	/	/
a	mitel	micollab	9.8	sp1	/	/	/	-	/	/

References

https://www.mitel.com/support/security-advisories

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029

CVSS Score

2.7 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: HIGH
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

View Vector String

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Date

Published: Dec. 10, 2024, 7:15 p.m.
Last Modified: Jan. 8, 2025, 8:46 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2024-55550