CVE-2023-39285: CSRF
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-39285?
CVE-2023-39285 is a vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) that could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation.
How does CVE-2023-39285 impact Mitel MiVoice Connect?
CVE-2023-39285 could allow an attacker to perform a CSRF attack on Mitel MiVoice Connect, potentially leading to unauthorized modifications or actions.
What is the severity of CVE-2023-39285?
CVE-2023-39285 has a severity rating of medium with a CVSS score of 4.3.
How do I check if my Mitel MiVoice Connect is affected by CVE-2023-39285?
You can check if your Mitel MiVoice Connect is affected by CVE-2023-39285 by verifying the software version is through 19.3 SP3 (22.24.5800.0) or earlier.
Is there a fix available for CVE-2023-39285?
Yes, Mitel has released a security advisory (23-0014) with mitigation steps to address CVE-2023-39285. Please refer to the advisory for more information.