A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts.
References
Configurations
Configuration 1 (hide)
|
History
07 Jul 2025, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mitel
Mitel mivoice Business Solution Virtual Instance Mitel micollab |
|
| CPE | cpe:2.3:a:mitel:mivoice_business_solution_virtual_instance:1.0.0.25:*:*:*:*:*:*:* cpe:2.3:a:mitel:micollab:*:*:*:*:*:*:*:* |
|
| References | () https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0015-001-v3.pdf - Broken Link | |
| References | () https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0015 - Vendor Advisory |
25 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-94 |
09 Jan 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
| CWE |
Information
Published : 2024-10-21 21:15
Updated : 2025-07-07 17:54
NVD link : CVE-2024-35314
Mitre link : CVE-2024-35314
CVE.ORG link : CVE-2024-35314
JSON object : View
Products Affected
mitel
- micollab
- mivoice_business_solution_virtual_instance
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')