Actively exploited in the wild
Mitel MiCollab Path Traversal Vulnerability
Mitel - MiCollab · Listed in the CISA KEV since 2025-01-07. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-55550
LowCVSS 2.7KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
Risk Assessment
The risk is limited to disclosure of non-sensitive system information, but it could aid further attacks.
Recommendation
It is recommended to upgrade to a version after 9.8 SP2 and restrict administrative access to trusted individuals.
Original NVD description (English source)
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.