CVE-2023-22854
Published: 13 February 2023
Summary
CVE-2023-22854 is a high-severity Numeric Range Comparison Without Minimum Check (CWE-839) vulnerability in Mitel Micontact Center Business. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 22.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26964
Vulnerability details
The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.