CVE-2020-11798
medium · 5.3A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
5.3
CVSS
48.8%
EPSS (exploit prob.)
99th
EPSS percentile
2020-06-10
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| mitel | micollab_audio,_web_&_video_conferencing | < 8.1.2.4 |
| mitel | micollab_audio,_web_&_video_conferencing | >= 9.0, < 9.1.3 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/171751/Mitel-MiCollab-AWV-8.1.2.4-9.1.3-Directory-Traversal-LFI.html
- https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin-20-0005-01.pdf
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
- http://packetstormsecurity.com/files/171751/Mitel-MiCollab-AWV-8.1.2.4-9.1.3-Directory-Traversal-LFI.html
- https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin-20-0005-01.pdf
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-11798