TI-2024-31555 Aliases CVE-2024-47189 GHSA-hq69-8v63-55qv

The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel…

LOW 34CWE-89Published 2024-10-21 · Updated 2024-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: SQL injection
Confidentiality · integrity · availability: Low · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct SQL injection due to insufficient sanitization of user input. A successful exploit could allow an attacker with knowledge of specific details to access non-sensitive user provisioning information and execute arbitrary SQL database commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00417 36th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mitel:micollab::::::::	up to 9.8.1.201	Vulnerable	Mitel

cpe:2.3:a:mitel:micollab:*:*:*:*:*:*:*:* Versions up to 9.8.1.201 Vulnerable ·Mitel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-47189
2026-10-03 Alias added: GHSA-hq69-8v63-55qv

References

Advisory 1

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0026

TI-2022-09601 The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice… KEVCVSS 3.1CRITICAL 9.8
TI-2024-27773 A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab… KEVCVSS 3.1CRITICAL 9.1
TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
TI-2024-23347 A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an… CVSS 3.1CRITICAL 9.8
TI-2024-36877 Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative… KEVCVSS 3.1MEDIUM 4.4
TI-2018-02664 Observable discrepancy in Intel Multiple CVSS 3.1MEDIUM 5.5

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences