CVEs / CVE-2024-55550
CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability
- Known exploited in the CISA KEV catalog since 7 Jan 2025
- low 2.7 CVSS 3.1 (NVD)
- EPSS 38.1% chance of exploitation in the next 30 days, higher than 98% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-55550
Summary
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Description
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 7 Jan 2025 |
|---|---|
| Due date for US federal agencies | 28 Jan 2025 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 2.7 lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NScored by NVD |
|---|---|
| Weakness | CWE-22 |
References
- CVE-2024-55550 on NVD
- CVE-2024-55550 in the CISA KEV catalog
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 (cited by CISA)
- https://www.mitel.com/support/security-advisories Vendor Advisory
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55550 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.