Information disclosure

2023-02-1318:15:00

PRIOn knowledge base

www.prio-n.com

mitel micontact center

information disclosure

unauthenticated access

arbitrary files

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.8%

JSON

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.

CPENameOperatorVersion
micontact_center_businessge9.2.2.0
micontact_center_businesslt9.4.2.0

CPE	Name	Operator	Version
	micontact_center_business	ge	9.2.2.0
	micontact_center_business	lt	9.4.2.0

References

www.mitel.com/support/security-advisories

www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0001