CVE-2023-22854

Опубликовано: 13 фев. 2023

Источник: nvd

CVSS3: 7.5

CVSS3: 9.1

EPSS Низкий

Описание

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.

Ссылки

https://www.mitel.com/support/security-advisories
Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0001
Vendor Advisory
https://www.mitel.com/support/security-advisories
Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0001
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mitel:micontact_center_business:*:*:*:*:*:*:*:*

Версия от 9.2.2.0 (включая) до 9.4.2.0 (исключая)

EPSS

Процентиль: 66%

0.00524

Низкий

7.5 High

CVSS3

9.1 Critical

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-839

Связанные уязвимости

GHSA-q7q7-xc84-hcqj

CVSS3: 7.5

github

почти 3 года назад

EPSS

Процентиль: 66%

0.00524

Низкий

7.5 High

CVSS3

9.1 Critical

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-839