Veille CVE
CVE-2022-29499
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Mitel MiVoice Connect Data Validation Vulnerability
Ajoutée le 27/06/2022 · Échéance de correction (agences US) : 18/07/2022
Action requise : Apply updates per vendor instructions.
Description
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 10.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 Vendor Advisory
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499 US Government Resource