CVE-2024-30158

A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0004	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mitel:micollab:*:*:*:*:*:*:*:*

History

25 Oct 2024, 16:30

Type	Values Removed	Values Added
CPE		cpe:2.3:a:mitel:micollab::::::::
First Time		Mitel micollab Mitel
References	~~() https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0004 -~~	() https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0004 - Vendor Advisory

23 Oct 2024, 15:12

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en el componente de conferencias web de Mitel MiCollab hasta la versión 9.7.1.110 podría permitir que un atacante autenticado con privilegios administrativos realice un ataque de inyección SQL debido a una validación insuficiente de la entrada del usuario. Una explotación exitosa podría permitir que un atacante ejecute operaciones arbitrarias de administración y base de datos.

22 Oct 2024, 14:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
CWE		CWE-89

21 Oct 2024, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-21 21:15

Updated : 2024-10-25 16:30

NVD link : CVE-2024-30158

Mitre link : CVE-2024-30158

CVE.ORG link : CVE-2024-30158

JSON object : View

Products Affected

mitel

micollab

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-30158", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-10-21T21:15:04.860", "references": [{"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0004", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary database and management operations."}, {"lang": "es", "value": "Una vulnerabilidad en el componente de conferencias web de Mitel MiCollab hasta la versi\u00f3n 9.7.1.110 podr\u00eda permitir que un atacante autenticado con privilegios administrativos realice un ataque de inyecci\u00f3n SQL debido a una validaci\u00f3n insuficiente de la entrada del usuario. Una explotaci\u00f3n exitosa podr\u00eda permitir que un atacante ejecute operaciones arbitrarias de administraci\u00f3n y base de datos."}], "lastModified": "2024-10-25T16:30:09.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mitel:micollab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00AF6EAC-B97B-468A-AE23-625321787BCA", "versionEndIncluding": "9.7.1.110"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}