PT-2018-3753 · Mitel · Mitel St 14.2

Harrison Coale · Publicado 2018-10-23 · Atualizado 2018-12-04 · CVE-2018-12901

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mitel ST 14.2 versions GA29 (19.49.9400.0) and earlier

Description The issue is related to insufficient validation for the "signin.php" page, which could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack. A successful exploit could enable an attacker to execute arbitrary scripts. The vulnerability is also described as being related to a lack of protection for the web page structure, which may allow a remote attacker to perform cross-site scripting attacks.

Recommendations For Mitel ST 14.2 versions GA29 (19.49.9400.0) and earlier, consider implementing additional validation for the signin.php page to prevent reflected XSS attacks. As a temporary workaround, restrict access to the signin.php page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2021-04422

CVE-2018-12901

Produtos afetados

Mitel St 14.2

Referências · 7

• https://bdu.fstec.ru/vul/2021-04422 · Nota de Segurança
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-18-0007 · Nota
• https://osv.dev/vulnerability/CVE-2018-12901 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12901 · Nota de Segurança
• https://cxsecurity.com/cveshow/CVE-2018-12901 · Nota
• https://vuldb.com/it/?id.125874 · Nota
• https://mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0007 · Aviso do Fabricante