CVE-2023-22854

Name of the Vulnerable Software and Affected Versions Mitel MiContact Center Business server versions 9.2.2.0 through 9.4.1.0

Description The ccmweb component could allow an unauthenticated attacker to download arbitrary files due to insufficient restriction of URL parameters. A successful exploit could allow access to sensitive information.

Recommendations For versions 9.2.2.0 through 9.4.1.0, consider restricting access to the ccmweb component until a patch is available. As a temporary workaround, limit the use of URL parameters to minimize the risk of exploitation.