PT-2024-7495 · Mitel · Mitel Micollab+1

CVE-2024-35314 · Published 2024-05-23 · Updated 2025-01-09

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions 9.7.1.110 and earlier MiVoice Business Solution Virtual Instance (MiVB SVI) version 1.0.0.25

Description: A vulnerability in the Desktop Client could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.

Recommendations: For Mitel MiCollab versions 9.7.1.110 and earlier, update to a version later than 9.7.1.110 to resolve the issue. For MiVoice Business Solution Virtual Instance (MiVB SVI) version 1.0.0.25, update to a version later than 1.0.0.25 to resolve the issue. As a temporary workaround, consider restricting user interaction with the Desktop Client to minimize the risk of exploitation.

Fix

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

BDU:2024-08877

CVE-2024-35314

Affected Products

Mivoice Business Solution Virtual Instance

Mitel Micollab

References · 10

• https://mitel.com/support/security-advisories/mitel-product-security-advisory-24-0015 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08877 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35314 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35314 · Vendor Advisory
• https://t.me/cvedetector/8579 · Telegram Post
• https://t.me/cvenotify/101112 · Telegram Post
• https://twitter.com/CVEnew/status/1849046773597401558 · Twitter Post
• https://mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0015-001-v3.pdf · Note
• https://twitter.com/VulmonFeeds/status/1848601574437761514 · Twitter Post
• https://mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0015-001-v2.pdf · Note