CVE-2023-31457 Missing authorization in n/a

What is CVE-2023-31457?

CVE-2023-31457 is a critical missing authorization vulnerability in n/a, published on 24 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

Which versions are affected by CVE-2023-31457?

It affects 1 product.

Products include Mitel Mivoice Connect.

How do I fix CVE-2023-31457?

No fix has been published for CVE-2023-31457 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-31457 being exploited?

There is no known exploitation of CVE-2023-31457 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-29499 Mitel MiVoice Connect Data Validation Exploited Critical 9.8
• CVE-2022-40765 Mitel MiVoice Connect Command Injection Exploited Medium 6.8
• CVE-2022-41223 Mitel MiVoice Connect Code Injection Exploited Medium 6.8
• CVE-2023-32748 Missing authorization in n/a Critical 9.8
• CVE-2023-31458 Auth bypass in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p636-9rpj-8948.