A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
References
Link | Resource |
---|---|
https://www.mitel.com/mitel-product-security-advisory-18-0003 | Broken Link Vendor Advisory |
https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf | Broken Link Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-04-25T20:00:00
Updated: 2018-04-25T19:57:01
Reserved: 2018-03-27T00:00:00
Link: CVE-2018-9104
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-04-25T20:29:00.760
Modified: 2018-05-24T15:35:46.197
Link: CVE-2018-9104
JSON object: View
Redhat Information
No data.
CWE