Mitel Product Security Advisory 20-0010
Mitel Product Security Advisory 20-0010
Mitel MiCloud Management Portal Multiple Security Vulnerabilities
Advisory ID: 20-0010
Publish Date: 2020-08-31
Last Updated: 2020-08-31
Revision: 1.0
Summary
Multiple vulnerabilities have been identified in Mitel MiCloud Management Portal:
A remote attacker could conduct a SQL Injection attack and access user credentials due to improper input validation. A successful exploit could allow an attacker to gain unauthorized access to sensitive information.
An unauthenticated attacker could execute arbitrary scripts due to insufficient input validation, aka Cross-Site Scripting (XSS). A successful exploit could allow an attacker to gain access to a user session.
An attacker by sending a crafted request, could retrieve sensitive information due to insufficient access control. A successful exploit could lead to the disclosure of sensitive information.
An attacker by sending a crafted request, could view system information due insufficient output sanitization. A successful exploit could lead to the disclosure of sensitive information.
Mitel is recommending customers with affected product versions to update to the latest release.
Affected Products
Product Name | Product Version | Security Bulletin | Last Updated |
---|---|---|---|
MiCloud Management Portal (MMP) | MMP 6.1 SP4 and earlier | 20-0010-001
| 2020-08-31 |
Risk Assessment
The risks for these vulnerabilities are rated from Low to High. Refer to the product Security Bulletins for additional statements regarding risk.
Mitigation / Recommended Action
Mitel has issued new releases of the affected software. Customers are advised to update their software to the latest versions.
Customers are advised to review the product Security Bulletin. For additional information, contact Product Support.
External References
N/A
Related CVEs / CWEs / Advisories
CVE-2020-24592
CVE-2020-24593
CVE-2020-24594
CVE-2020-24595
Revision History
Version | Date | Description |
---|---|---|
1.0 | 2020-08-31 | Initial Version |