CVE-2018-18819
Last modified
CVE-2018-18819 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. A successful exploit could allow execution of arbitrary commands.. EPSS estimates a 1.43% chance of exploitation in the next 30 days.
Description
A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions 7.3 PR3 (7.3.1.302) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP1 (8.0.2.202), could allow creation of unauthorized chat sessions, due to insufficient access controls. A successful exploit could allow execution of arbitrary commands.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mitel | Micollab | >= 7.3, <= 7.3.0.601 |
| Mitel | Micollab | >= 8.0.0.40, <= 8.0.2.202 |
| Mitel | Mivoice Business Express | >= 7.0, <= 7.3.1.302 |
| Mitel | Mivoice Business Express | >= 8.0.0.40, <= 8.0.2.202 |
References
- https://www.mitel.com/support/security-advisoriesVendor Advisory
- https://www.mitel.com/support/security-advisoriesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-18819?
How severe is CVE-2018-18819?
How do I fix CVE-2018-18819?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-18812The Spotfire Library component of TIBCO Software Inc.'s TIBC…6.5
- CVE-2018-18813The Spotfire web server component of TIBCO Software Inc.'s T…8.8
- CVE-2018-18814The TIBCO Spotfire authentication component of TIBCO Softwar…8.8
- CVE-2018-18815The REST API component of TIBCO Software Inc.'s TIBCO Jasper…10
- CVE-2018-18816The repository component of TIBCO Software Inc.'s TIBCO Jasp…8
- CVE-2018-18817The Leostream Agent before Build 7.0.1.0 when used with Leos…
- CVE-2018-1882In a certain atypical IBM Spectrum Protect 7.1 and 8.1 confi…4.7
- CVE-2018-18820A buffer overflow was discovered in the URL-authentication b…
- CVE-2018-18822Grapixel New Media v2.0 allows SQL Injection via the pages.a…
- CVE-2018-18823WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugi…
- CVE-2018-18824WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plug…
- CVE-2018-18825Pagoda Linux panel V6.0 has XSS via the verification code as…
Are you affected by CVE-2018-18819?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST