PT-2018-3753 · Mitel · Mitel St 14.2

Harrison Coale · Published 2018-10-23 · Updated 2018-12-04 · CVE-2018-12901

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mitel ST 14.2 versions GA29 (19.49.9400.0) and earlier

Description The issue is related to insufficient validation for the "signin.php" page, which could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack. A successful exploit could enable an attacker to execute arbitrary scripts. The vulnerability is also described as being related to a lack of protection for the web page structure, which may allow a remote attacker to perform cross-site scripting attacks.

Recommendations For Mitel ST 14.2 versions GA29 (19.49.9400.0) and earlier, consider implementing additional validation for the signin.php page to prevent reflected XSS attacks. As a temporary workaround, restrict access to the signin.php page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04422

CVE-2018-12901

Affected Products

Mitel St 14.2

References · 7

• https://bdu.fstec.ru/vul/2021-04422 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12901 · Security Note
• https://mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0007 · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-18-0007 · Note
• https://cxsecurity.com/cveshow/CVE-2018-12901 · Note
• https://vuldb.com/it/?id.125874 · Note