CVE-2024-41713 Mitel MiCollab Path Traversal
Unauthenticated attackers can exploit path traversal in Mitel MiCollab to view, corrupt, or delete user data and system configurations.
- Exploited in the wild
- Since 7 Jan 2025
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41713?
CVE-2024-41713 is a critical path traversal vulnerability in n/a, published on 21 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or delete users' data and system configurations.
Weakness: CWE-22
Which versions are affected by CVE-2024-41713?
It affects 1 product.
Products include Mitel Micollab.
How do I fix CVE-2024-41713?
No fix has been published for CVE-2024-41713 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Jan 2025.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-41713 being exploited?
Yes. Attackers have exploited CVE-2024-41713 in the wild since at least 7 Jan 2025, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8v9w-9wj4-52p3.