CVE-2018-18819 Missing authorization in n/a

What is CVE-2018-18819?

CVE-2018-18819 is a medium-severity missing authorization vulnerability in n/a, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. A successful exploit could allow execution of arbitrary commands.

Weakness: CWE-863

Which versions are affected by CVE-2018-18819?

It affects 2 products.

Products include Mitel Micollab, Mitel Mivoice Business Express.

How do I fix CVE-2018-18819?

No fix has been published for CVE-2018-18819 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-18819 being exploited?

There is no known exploitation of CVE-2018-18819 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-26143 MiCollab, MiVoice Business Express Access Control Exploited Critical 9.8
• CVE-2024-41713 Mitel MiCollab Path Traversal Exploited Critical 9.1
• CVE-2024-55550 Mitel MiCollab Path Traversal Exploited Medium 4.4
• CVE-2024-35285 Command injection in n/a Critical 9.8
• CVE-2024-35286 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m8mf-8j96-ph83.