PT-2022-23376 · Mitel · Mitel Micollab

Shaquin Trifonoff · Published 2022-10-25 · Updated 2022-10-31 · CVE-2022-36452

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions through 9.5.0.101

Description A vulnerability in the web conferencing component could allow an unauthenticated attacker to upload malicious files, potentially leading to the execution of arbitrary code within the context of the application.

Recommendations For versions through 9.5.0.101, update to a version that contains a fix for this issue to prevent the upload of malicious files and potential code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-36452

Affected Products

Mitel Micollab

References · 5

• https://mitel.com/support/security-advisories/mitel-product-security-advisory-22-0006 · Vendor Advisory
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36452 · Security Note
• https://t.me/cibsecurity/52063 · Telegram Post