CVE-2024-41714 Command injection in n/a
Authenticated attackers can execute arbitrary commands with elevated privileges via command injection in the Mitel MiCollab Web Interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41714?
CVE-2024-41714 is a high-severity command injection vulnerability in n/a, published on 21 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.
Weakness: CWE-94
Which versions are affected by CVE-2024-41714?
It affects 2 products.
Products include Mitel Micollab, Mitel Mivoice Business Solution Virtual Instance.
How do I fix CVE-2024-41714?
No fix has been published for CVE-2024-41714 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-41714 being exploited?
There is no known exploitation of CVE-2024-41714 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-x6mc-vf2q-ph77.