CVE-2023-32748 Missing authorization in n/a

What is CVE-2023-32748?

CVE-2023-32748 is a critical missing authorization vulnerability in n/a, published on 14 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

Weakness: CWE-863

Which versions are affected by CVE-2023-32748?

It affects 1 product.

Products include Mitel Mivoice Connect.

How do I fix CVE-2023-32748?

No fix has been published for CVE-2023-32748 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-32748 being exploited?

There is no known exploitation of CVE-2023-32748 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-29499 Mitel MiVoice Connect Data Validation Exploited Critical 9.8
• CVE-2022-40765 Mitel MiVoice Connect Command Injection Exploited Medium 6.8
• CVE-2022-41223 Mitel MiVoice Connect Code Injection Exploited Medium 6.8
• CVE-2023-31457 Missing authorization in n/a Critical 9.8
• CVE-2023-31458 Auth bypass in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rgw7-4fxp-8gxg.