medium5.3Public exploit code
CVE-2020-11798
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI2023-04-06 · webapps · cgi
Impact
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mitel | Micollab Audio\, Web \& Video Conferencing | before 8.1.2.4 from 9.0 before 9.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171751/Mitel-MiCollab-AWV-8.1.2.4-9.1.3-Directory-Traversal-LFI.html
- https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin-20-0005-01.pdf
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
- http://packetstormsecurity.com/files/171751/Mitel-MiCollab-AWV-8.1.2.4-9.1.3-Directory-Traversal-LFI.html
- https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin-20-0005-01.pdf
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005