CVE-2017-16251

A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of the application.

CVSS v3.0

8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

1.75% chance of exploitation in the next 30 days, 76th percentile

Published

2018-03-13

Updated

2024-08-05

Proof-of-concept exploits (1)

• twosevenzero/shoretel-mitel-rce3★ · 2019-01-09

References

• CVE Record
• NVD entry

Related

• CVE-2017-16249
• CVE-2017-16252
• CVE-2017-16244
• CVE-2017-16253
• CVE-2017-16237
• CVE-2017-16254