LOGIN PORTAL
Americas
Oceania
Solutions
Business Size
Industries
Partners
App & Developers
Services
Training
Mitel User Group
Support
Partners
Unified Communications Collaboration
Contact Center
Devices
Newsroom
Customer Success
Blog
Resource Center
Careers
Location: United States
Advisory ID: 21-0004
Publish Date: 2021-03-09
Last Updated: 2021-03-09
Revision: 1.0
Following multiple vulnerabilities were privately reported to Mitel
The SAS Admin portal of Mitel MiCollab could allow an unauthenticated attacker to access user data by injecting arbitrary directory paths due to improper
URL validation, aka Directory Traversal. A successful exploit could allow an attacker to view and modify MiCollab user data.
The Join Meeting page of Mitel MiCollab Web Client could allow an attacker to access user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS). A successful exploit could allow an attacker to view and modify MiCollab user data.
Mitel is recommending customers with affected product versions to update to the latest release.
Product Name | Product Version | Security Bulletin | Last Updated |
---|---|---|---|
MiCollab | MiCollab 9.2 FP1 and earlier | 21-0004-001 21-0004-002 |
2021-03-09 |
The risks for these vulnerabilities are rated from Medium to High. Refer to the product Security Bulletins for additional statements regarding risk.
Version | Date | Description |
---|---|---|
1.0 | 2021-03-09 | Initial Version |