Mitel MiCollab Path Traversal Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Dec 10, 2024 · Catalog

   Detected

   Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not al

2. Jan 7, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

3. Jan 28, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

4. Aug 3, 2026 · Catalog

   Updated

   Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not al

Affected

• cpe mitel/micollabversion unspecified
• vendor Mitel MiCollabversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2024-55550

  Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.

  cisa.gov
• CVE.orgVulnerability recordCVE-2024-55550

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2024-55550

  30-day exploitation probability 38.2%

  first.org
• NIST NVDVulnerability recordCVE-2024-55550

  Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to t

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Vendor Advisory · mitel.com
• CISA note · mitel.com