CVE-2024-47189

Katalog CVE

CVSS 7.7 · High EPSS 0,42%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada mitel micollab. Skor CVSS 3.1 7.7 (High) menurut CISA ADP.

Deskripsi (NVD)

The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands.

Rincian

Terbit di NVD

21 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0026 advisory vendor