PT-2022-25816 · Mitel · Mitel Micollab

Published 2022-11-22 · Updated 2023-08-08 · CVE-2022-41326

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions through 9.6.0.13

Description The web conferencing component could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.

Recommendations For versions through 9.6.0.13, update to a version later than 9.6.0.13 to resolve the issue. As a temporary workaround, consider restricting access to the web conferencing component to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-41326

Affected Products

Mitel Micollab

References · 5

• https://mitel.com/support/security-advisories/mitel-product-security-advisory-22-0009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41326 · Security Note
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41326 · Vendor Advisory
• https://t.me/cibsecurity/53309 · Telegram Post