PT-2023-18730 · Mitel · Mitel Micontact Center Business

Published 2023-02-13 · Updated 2025-03-21 · CVE-2023-22854

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Business server versions 9.2.2.0 through 9.4.1.0

Description The ccmweb component could allow an unauthenticated attacker to download arbitrary files due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.

Recommendations For versions 9.2.2.0 through 9.4.1.0, consider restricting access to the ccmweb component until a patch is available. As a temporary workaround, limit the use of URL parameters to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-839

Related Identifiers

CVE-2023-22854

Affected Products

Mitel Micontact Center Business

References · 7

• https://osv.dev/vulnerability/CVE-2023-22854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22854 · Security Note
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-23-0001 · Vendor Advisory
• https://t.me/cibsecurity/58009 · Telegram Post
• https://t.me/cvenotify/44271 · Telegram Post
• https://t.me/cvenotify/115735 · Telegram Post