Local File Read Vulnerability in Mitel MiCollab Product
CVE-2024-55550

2.7LOW

Key Information:

Vendor: Mitel
Status: Micollab
Vendor: CVE Published:; 10 December 2024

Badges

👾 Exploit Exists🟣 EPSS 42%🦅 CISA Reported📰 News Worthy

Summary

Mitel MiCollab versions up to 9.8 SP2 are susceptible to a local file read vulnerability. Authenticated attackers with administrative privileges can exploit this issue due to insufficient input sanitization. This flaw enables access to resources typically restricted to admin-level access, allowing disclosure of non-sensitive system information. However, this vulnerability does not permit file modifications or privilege escalations.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

News Articles

SC Media

CVE-2024-41713 CVE-2024-55550

CISA adds Mitel and Oracle bugs to exploited vulnerabilities list

Two Mitel MiCollab bugs were added to the KEV catalog, while a patched Oracle WebLogic Server exploit is still under threat.

11 hours ago

The Register

CVE-2024-55550 CVE-2024-41713

Mitel 0-day, 5-year-old Oracle RCE exploited in the wild

Cybercriminals are actively exploiting two vulnerabilities in Mitel MiCollab, including a zero-day flaw – and a critical remote code execution vulnerability in Oracle WebLogic Server that has been abused for...

6 days ago

Help Net Security

CVE-2024-41713 CVE-2024-55550

Mitel MiCollab, Oracle WebLogic Server vulnerabilities exploited by attackers - Help Net Security

CISA has added Mitel MiCollab and Oracle WebLogic Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

6 days ago

References

https://www.mitel.com/support/security-advisories

https://www.mitel.com/support/security-advisories/mitel-p...

EPSS Score

42% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

2.7

Severity:

LOW

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction: