Mitel Product Security Advisory 21-0003

Mitel Product Security Advisory 21-0003

Mitel MiContact Center Enterprise - Directory Traversal Vulnerability

Advisory ID: 21-0003

Publish Date: 2021-02-16

Last Updated: 2021-02-16

Revision: 1.0

Summary

The Enterprise License Manager portal in Mitel MiContact Center Enterprise could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal.

Credit is given to Nicolai Grødum from PricewaterhouseCoopers AS, for highlighting this issue and bringing this to our attention.

Mitel is recommending customers with affected product versions to update to the latest release.

Affected Products

Product NameProduct VersionSecurity BulletinLast Updated
MiContact Center EnterpriseMiContact Center Enterprise 9.3 SP3 and earlier21-0003-0012021-02-16

Risk Assessment

The risk for this vulnerability is rated as High. Refer to the product Security Bulletins for additional statements regarding risk.

Mitigation / Recommended Action

Mitel has issued new release of the affected software. Customers are advised to update their software to the latest version. Customers are advised to review the product Security Bulletin. For additional information, contact Product Support.

External References

N/A

Related CVEs / CWEs / Advisories

CVE-2021-26714

Revision History

VersionDateDescription
1.02021-02-16 Initial version

 

 

Stay One Step Ahead Get notifications of the latest security advisories sent right to your inbox every week!