Improper Authentication in Mitel MiCollab Web Conferencing Component
CVE-2023-25597

5.9MEDIUM

Key Information:

Vendor

Mitel
Status
Micollab
Vendor
CVE Published:
14 April 2023

What is CVE-2023-25597?

A security flaw exists in the web conferencing component of Mitel MiCollab versions through 9.6.2.9, which could be exploited by an unauthenticated attacker. This vulnerability allows the attacker to craft a request that could facilitate the download of shared files by revealing their exact path and filename. The lack of proper authentication controls could lead to unauthorized access to sensitive files, posing significant risks to data confidentiality.

References

https://www.mitel.com/support/security-advisories/mitel-p...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.