PT-2018-4958 · Shoretel · Shoretel Mobility Client

David Coomber · Publicado 2018-07-13 · Atualizado 2019-10-09 · CVE-2016-6562

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShoreTel Mobility Client app version 9.1.3.109

Description The issue is related to the failure of the ShoreTel Mobility Client app to properly validate SSL certificates provided by HTTPS connections. This could allow an attacker, in a position to perform a man-in-the-middle (MITM) attack, to obtain sensitive account information, such as login credentials.

Recommendations For version 9.1.3.109, consider disabling the use of HTTPS connections until a patch is available that properly validates SSL certificates. Restrict access to sensitive account information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-6562

Produtos afetados

Shoretel Mobility Client

Referências · 5

• https://securityfocus.com/bid/95224 · Nota
• https://kb.cert.org/vuls/id/475907 · Nota
• https://osv.dev/vulnerability/CVE-2016-6562 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6562 · Nota de Segurança
• https://info-sec.ca/advisories/ShoreTel-Mobility.html · Nota