PT-2024-22251 · Mitel · Mitel Micontact Center Business

Published 2024-03-15 · Updated 2025-06-02 · CVE-2024-28070

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Business versions through 10.0.0.4

Description A vulnerability in the legacy chat component could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access.

Recommendations For versions through 10.0.0.4, consider disabling the legacy chat component as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using the legacy chat component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-28070

Affected Products

Mitel Micontact Center Business

References · 8

• https://osv.dev/vulnerability/CVE-2024-28070 · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-24-0002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28070 · Security Note
• https://twitter.com/VulmonFeeds/status/1768950301803917447 · Twitter Post
• https://t.me/cvenotify/74025 · Telegram Post
• https://t.me/cvenotify/124340 · Telegram Post
• https://twitter.com/CVEnew/status/1768874889325494761 · Twitter Post
• https://t.me/cvenotify/115573 · Telegram Post