CVE-2023-39285

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014	Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-14 19:16

Updated : 2024-11-21 08:15

NVD link : CVE-2023-39285

Mitre link : CVE-2023-39285

CVE.ORG link : CVE-2023-39285

JSON object : View

Products Affected

mitel

mivoice_connect

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-39285", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-09-14T19:16:50.847", "references": [{"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings."}, {"lang": "es", "value": "Una vulnerabilidad en el componente Edge Gateway de Mitel MiVoice Connect hasta 19.3 SP3 (22.24.5800.0) podr\u00eda permitir que un atacante no autenticado realice un ataque de Cross Site Request Forgery (CSRF) debido a una validaci\u00f3n de la solicitud insuficiente. Un exploit exitoso podr\u00eda permitir a un atacante proporcionar una URL modificada, lo que potencialmente le permitir\u00eda modificar la configuraci\u00f3n del sistema."}], "lastModified": "2024-11-21T08:15:04.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "831DFDAA-0551-40E4-8E36-85840CA972B7", "versionEndExcluding": "22.24.7100.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}