CVE-2021-27402

Опубликовано: 13 авг. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 6.4

EPSS Низкий

Описание

The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary directory paths due to improper URL validation, aka Directory Traversal.

Ссылки

https://www.mitel.com/support/security-advisories
Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004
Vendor Advisory
https://www.mitel.com/support/security-advisories
Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*

Версия до 9.2 (исключая)

cpe:2.3:a:mitel:micollab:9.2:-:*:*:*:-:*:*

cpe:2.3:a:mitel:micollab:9.2:fp1:*:*:*:-:*:*

EPSS

Процентиль: 53%

0.00304

Низкий

6.5 Medium

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-q747-vr2x-33cp

github

больше 3 лет назад