Lucene search

[email protected]CVE-2019-19607

HistoryMar 02, 2020 - 6:15 p.m.

CVE-2019-19607

2020-03-0218:15:11

CWE-89

[email protected]

web.nvd.nist.gov

cve-2019-19607

sql injection

mitel micollab awv

web conferencing

security vulnerability

unauthenticated attack

input validation

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.

Affected configurations

NVD

Node

mitelmicollab_audio\,_web_\&_video_conferencingRange≤8.0.2.301

mitelmicollab_audio\,_web_\&_video_conferencingRange8.1–8.1.1.11

CPENameOperatorVersion
mitel:micollab_audio\,_web_\&_video_conferencingmitel micollab audio, web & video conferencingle8.0.2.301
mitel:micollab_audio\,_web_\&_video_conferencingmitel micollab audio, web & video conferencingle8.1.1.11

CPE	Name	Operator	Version
mitel:micollab_audio\,_web_\&_video_conferencing	mitel micollab audio, web & video conferencing	le	8.0.2.301
mitel:micollab_audio\,_web_\&_video_conferencing	mitel micollab audio, web & video conferencing	le	8.1.1.11

References

www.mitel.com/support/security-advisories

www.mitel.com/support/security-advisories/mitel-product-security-advisory-19-0007

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

Related for CVE-2019-19607

nvd1 cvelist1 prion1