CVE-2023-39286

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015	Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mitel:connect_mobility_router:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-14 19:16

Updated : 2024-11-21 08:15

NVD link : CVE-2023-39286

Mitre link : CVE-2023-39286

CVE.ORG link : CVE-2023-39286

JSON object : View

Products Affected

mitel

connect_mobility_router

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-39286", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-09-14T19:16:50.907", "references": [{"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0015", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings."}, {"lang": "es", "value": "Una vulnerabilidad en el componente Connect Mobility Router de Mitel MiVoice Connect hasta 9.6.2304.102 podr\u00eda permitir que un atacante no autenticado realice un ataque de Cross Site Request Forgery (CSRF) debido a una validaci\u00f3n de la solicitud insuficiente. Un exploit exitoso podr\u00eda permitir a un atacante proporcionar una URL modificada, lo que potencialmente le permitir\u00eda modificar la configuraci\u00f3n del sistema."}], "lastModified": "2024-11-21T08:15:04.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mitel:connect_mobility_router:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95732356-9292-4D88-9346-28F4328919ED", "versionEndExcluding": "9.6.2307.111"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}