CVE-2019-19370 — Cross-site Scripting in Micollab

CWE-79 — Cross-site Scripting3 documents3 sources

Severity

6.1MEDIUMNVD

EPSS

0.8%

top 26.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mitel Micollab

Timeline

PublishedMar 2

Latest updateMay 24

Description

A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file upload interface. A successful exploit could allow an attacker to execute arbitrary scripts.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDmitel/micollab< 9.0.15

🔴Vulnerability Details

GHSA

GHSA-2j6m-77gv-ggf6: A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9↗2022-05-24

▶

CVEList

CVE-2019-19370: A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9↗2020-03-02

▶