PT-2024-32470 · Mitel · Mitel Micollab

Patrick Webster · Published 2024-10-21 · Updated 2025-07-07 · CVE-2024-47189

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions through 9.8 SP1 FP2 (9.8.1.201)

Description The issue concerns the API Interface of the AWV component, where insufficient sanitization of user input could allow an unauthenticated attacker to conduct SQL injection. This could enable an attacker with specific knowledge to access non-sensitive user provisioning information and execute arbitrary SQL database commands.

Recommendations For versions through 9.8 SP1 FP2 (9.8.1.201), as a temporary workaround, consider restricting access to the API Interface of the AWV component until a patch is available. Avoid using user input in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-47189

Affected Products

Mitel Micollab

References · 4

• https://mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0026 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47189 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47189 · Security Note
• https://t.me/cvenotify/127882 · Telegram Post