Descripción
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de mitel.com mitel.com/support/security-advisories/mitel-product-security-advisory…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2024-55550
Otras vulnerabilidades de Mitel en el catálogo
- CVE-2024-41710 Vulnerabilidad de inyección de argumentos en Mitel SIP Phones Alta 12-02-2025
- CVE-2024-41713 Mitel MiCollab Path Traversal Vulnerability Alta 07-01-2025
- CVE-2022-41223 Mitel MiVoice Connect Code Injection Vulnerability Alta 21-02-2023
- CVE-2022-40765 Mitel MiVoice Connect Command Injection Vulnerability Alta 21-02-2023
- CVE-2022-29499 Mitel MiVoice Connect Data Validation Vulnerability Alta 27-06-2022