CVE-2023-22854

High

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download…

mitre·NVD-CWE-noinfo·Published 2023-02-13

CVSS

7.5

EPSS

0.01

KEV

Exploits

cve.orgen

272 chars

The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.

NVDen

272 chars

NVDes

297 chars

El componente ccmweb del servidor Mitel MiContact Center Business 9.2.2.0 a 9.4.1.0 podría permitir a un atacante no autenticado descargar archivos arbitrarios, debido a una restricción insuficiente de los parámetros de URL. Un exploit exitoso podría permitir el acceso a información confidencial.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
3.1	Secondary	NVD	9.1	3.9	5.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N