An alert about “critical” vulnerabilities involving Mitel MiCollab collaboration applications has been issued by the Australian Signals Directorate (ASD).
The Australian Cyber Security Center is tracking multiple vulnerabilities in Mitel MiCollab collaboration software, which were described as SQL injection and Authentication Bypass/Path Traversal, which may allow access to sensitive content.
There is “significant exposure to the Mitel MiCollab vulnerabilities in Australia and that any exploitation would have significant impact to Australian systems and networks”, according to the ASD.
The vulnerabilities involve Mitel MiCollab version 9.8 SP1 FP2 (9.8.1.201) and earlier, according to the ASD.
The ASD advised organisations to investigate systems to determine if they are at risk, upgrade to the latest version if possible, and monitor vendor advisories for further patch releases and information.
It also advised that while organisations assess and determine their ability to apply patches, they should also consider implementing ACLs or firewall policies to limit access to the MiCollab server to trusted IP ranges or internal networks only.
The ASD also recommended monitoring logs for suspicious activity targeting the ReconcileWizard servlet or path traversal patterns, monitoring for unexpected access to sensitive files or configuration data, and if feasible, disabling or restricting access to the ReconcileWizard servlet.
_page-0001.jpg&w=100&c=1&s=0)
-1.jpg&w=100&c=1&s=0)
.png&w=100&c=1&s=0)
