CVE-2024-41713criticalunder attackransomwareCWE-22

CVE-2024-41713

Published · Updated

Follow this CVE+ Monitor MiCollab

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.1epss 97%
from disclosure to weapon42 days
Published on NVDOct 21
1st PoC+42d
CISA KEV+78d
Action required by CISAfederal deadline: 2025-01-28

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Mitel MiCollab's messaging system allows attackers to bypass security and access files they shouldn't, potentially viewing or deleting user data and system settings without needing a password.

Technical detail

Path traversal vulnerability in NuPoint Unified Messaging component due to insufficient input validation permits unauthenticated attackers to access arbitrary files on the system. Exploitation enables unauthorized data access, modification, and deletion of user information and critical configurations.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.