Security Vulnerabilities fixed in Mitel Connect 19.3 SP1

Description

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

Affected Applications

Mitel Connect

CVE References

CVE-2022-40765 CVE-2022-41223

Other References

https://www.mitel.com/support/security-advisories