Multiple vulnerabilities in Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI)
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2024-35314 CVE-2024-35315 |
| CWE-ID | CWE-88 CWE-264 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software Subscribe |
MiCollab Server applications / Conferencing, Collaboration and VoIP solutions MiVoice Business Solution Virtual Instance (MiVB SVI) Server applications / Conferencing, Collaboration and VoIP solutions |
| Vendor | Mitel |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Improper Neutralization of Argument Delimiters in a Command
EUVDB-ID: #VU90707
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-35314
CWE-ID:
CWE-88 - Argument Injection or Modification
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary argument.
The vulnerability exists due to insufficient parameter sanitization. A remote attacker can execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMiCollab: 9.7.1.110
MiVoice Business Solution Virtual Instance (MiVB SVI): 1.0.0.25
External linkshttp://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0015
http://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin240015001-v10.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU90709
Risk: Low
CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2024-35315
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: Yes
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper file validation, which leads to security restrictions bypass and privilege escalation.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMiCollab: 9.7.1.110
MiVoice Business Solution Virtual Instance (MiVB SVI): 1.0.0.25
External linkshttp://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0016
http://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin240016001-v10.pdf
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
