CVE-2024-42514 Missing authorization in n/a
Unauthenticated attackers can access sensitive information and send unauthorized messages in active chat sessions due to inadequate access controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-42514?
CVE-2024-42514 is a high-severity missing authorization vulnerability in n/a, published on 1 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to access sensitive information and send unauthorized messages during an active chat session.
Weakness: CWE-284
Which versions are affected by CVE-2024-42514?
It affects 1 product.
Products include Mitel Micontact Center Business.
How do I fix CVE-2024-42514?
No fix has been published for CVE-2024-42514 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-42514 being exploited?
There is no known exploitation of CVE-2024-42514 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jq66-g5qg-w7wf.