Mitel Product Security Advisory 22-0006

Mitel MiCollab Multiple Security Vulnerabilities

Advisory ID: 22-0006

Publish Date: 2022-07-27

Last Updated: 2022-08-29

Revision: 3.0

 

Summary

The following vulnerabilities were privately reported to Mitel.

A vulnerability has been identified in the web conferencing component of MiCollab which could allow upload of malicious files. A successful exploit could allow an attacker to execute arbitrary code within the context of the application.

A vulnerability has been identified in the MiCollab Client server component of MiCollab which could allow a Server-Side Request Forgery attack. A successful exploit could allow an attacker to leverage connections and permissions available to the host server.

Credit is given to Shaquin Trifonoff of Lateral Security for highlighting these two issues and bringing to our attention.

A vulnerability has been identified in the MiCollab Client API component of MiCollab which could allow an authenticated attacker to control another extension number or allow an authenticated attacker to impersonate another user's name.

Mitel is recommending customers with affected product versions apply the available remediation.

 

 

Affected Products

Note: MiVoice Business Express included earlier versions of MiCollab and is also affected.

 

Risk Assessment

The risks for these vulnerabilities are rated from Medium to Critical. Refer to the product Security Bulletin for additional statements regarding risk.

 

Mitigation / Recommended Action

Mitel has issued a new release of MiCollab, and mitigations for earlier releases. Customers are advised to update to the latest version.

Customers are advised to review the product Security Bulletins. For additional information, contact Mitel Product Support.

 

Related CVEs / CWEs / Advisories

CVE-2022-36451 CVE-2022-36452 CVE-2022-36453 CVE-2022-36454

 

Revision History

Version Date Description
1.0 2022-07-27 Initial Version
2.0 2022-08-08 Updated assessment and bulletins
3.0 2022-08-29 Updated bulletins
Prêt à discuter ? Contactez-nous.
Trouver un partenaire +33 (0)1 30 96 44 00 Contactez-nous