FKIE_CVE-2021-27401

Vulnerability from fkie_nvd - Published: 2021-08-13 16:15 - Updated: 2024-11-21 05:57
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS).
References
cve@mitre.orghttps://www.mitel.com/support/security-advisoriesVendor Advisory
cve@mitre.orghttps://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.mitel.com/support/security-advisoriesVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004Vendor Advisory
Impacted products
Vendor Product Version
mitel micollab *
mitel micollab 9.2
mitel micollab 9.2
To clipboard Create KEV Entry 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "200AECAB-6B5A-4881-852F-F9ABFB241E3C",
              "versionEndExcluding": "9.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mitel:micollab:9.2:-:*:*:*:-:*:*",
              "matchCriteriaId": "7F557ADB-202D-4A6C-869E-38629240CC9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mitel:micollab:9.2:fp1:*:*:*:-:*:*",
              "matchCriteriaId": "61A8FD1A-8F20-47CE-80E1-5E59B70507A8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due to insufficient input validation, aka Cross-Site Scripting (XSS)."
    },
    {
      "lang": "es",
      "value": "La p\u00e1gina Join Meeting de Mitel MiCollab Web Client versiones anteriores a 9.2 FP2, podr\u00eda permitir a un atacante acceder (visualizar y modificar) datos del usuario mediante una ejecuci\u00f3n de c\u00f3digo arbitrario debido a una comprobaci\u00f3n insuficiente de entrada, tambi\u00e9n se conoce como Cross-Site Scripting (XSS)."
    }
  ],
  "id": "CVE-2021-27401",
  "lastModified": "2024-11-21T05:57:55.267",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-08-13T16:15:07.207",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mitel.com/support/security-advisories"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0004"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.