CVE-2024-35286
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.
Risk Assessment
An attacker could access sensitive data and perform administrative operations in the database, potentially compromising confidentiality and integrity.
Recommendation
Update Mitel MiCollab to a version later than 9.8.0.33. Until patched, restrict access to the NPM interface.
Other vulnerabilities in Mitel MiCollab
See all- CVE-2024-55550LowActively exploited
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
- CVE-2024-41713CriticalActively exploited
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. Successful exploit could allow unauthorized access, enabling viewing, corrupting, or deleting users' data and system configurations.
Original NVD description (English source)
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary database and management operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS