CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2024-47223

CVSS 9.4v3.1pub. 2024-10-21upd. 2025-07-07

A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Mitel Micollab
APP
Mitel
≤ 9.8.1.201

🟢

PATCH AVAILABLE

Vendor update available. Deploy in standard maintenance cycle.

Tags

SQLiAuth Bypass

CWE

References

www.mitel.com/support/security-advisories/mitel-product…

Related vulnerabilities

CVE-2024-41713CRITICAL9.1⚠ KEVPL ✓ten sam produkt

Path Traversal w Mitel MiCollab — nieautoryzowany dostęp do danych

CVE-2022-26143CRITICAL9.8⚠ KEVten sam produkt

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through ...

CVE-2024-35286CRITICAL9.8PL ✓ten sam produkt

SQL Injection w Mitel MiCollab NuPoint Messenger — dostęp bez uwierzytelnienia

CVE-2024-35285CRITICAL9.8PL ✓ten sam produkt

Command injection w Mitel MiCollab NuPoint Messenger — dostęp bez uwierzytelnienia

CVE-2024-35314CRITICAL9.8PL ✓ten sam produkt

Command Injection w Mitel MiCollab i MiVoice Business Solution Virtual Instance