PT-2020-13200 · Mitel · Mivoice Connect+1

Jill Kamperides + 1 · Published 2020-05-07 · Updated 2020-05-12 · CVE-2020-12679

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mitel ShoreTel Conference Web Application versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2

Description A reflected cross-site scripting (XSS) issue allows remote attackers to inject arbitrary JavaScript and HTML via the PATH INFO to "home.php". This enables attackers to execute malicious scripts on the client-side, potentially leading to unauthorized actions or data exposure.

Recommendations For versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2, update to MiVoice Connect 18.7 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "home.php" endpoint to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12679

Affected Products

Mivoice Connect

Mitel Shoretel Conference Web Application

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-12679 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12679 · Vendor Advisory
• https://t.me/cvenotify/3624 · Telegram Post
• https://gist.github.com/kampji/5ade2d15817650a725aa89fa2e6e4752 · Note