CVE-2020-12456

 

Published at: - 26-08-2020 09:15

Last modified: - 25-11-2022 04:22

Total changes: - 3

Description

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform directory traversal, and execute arbitrary scripts in the context of the Connect client.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.mitel.com/support/security-advisories
• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0006

 

Keywords

NVD

 

CVE-2020-12456

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures