{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/micollab--9.8.1.201/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2024-41713"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MiCollab (\u003c= 9.8.1.201)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","file-read","path-traversal"],"_cs_type":"advisory","_cs_vendors":["Mitel"],"content_html":"\u003cp\u003eCVE-2024-41713 is an authentication bypass and arbitrary file read vulnerability affecting Mitel MiCollab versions 9.8.1.201 and earlier. The vulnerability allows unauthenticated attackers to access sensitive files on the host system. Public proof-of-concept (PoC) exploit scripts are available, demonstrating the ability to read system files like '/etc/passwd'. The vulnerability carries a CVSS score of 9.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read arbitrary files from the filesystem of the affected Mitel MiCollab instance. This can lead to the exposure of credentials, configuration files, and other sensitive system information, facilitating further unauthorized access or escalation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Mitel MiCollab within the environment.\u003c/li\u003e\n\u003cli\u003ePatch affected instances of Mitel MiCollab to a version beyond 9.8.1.201 immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, restrict network access to the MiCollab interface to trusted IP addresses only.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious requests containing path traversal sequences (e.g., '..', '/etc/passwd') targeting the MiCollab application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:37:52Z","date_published":"2026-10-23T16:37:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mitel-micollab-auth-bypass/","summary":"An authentication bypass vulnerability in Mitel MiCollab versions 9.8.1.201 and earlier enables unauthenticated attackers to perform arbitrary file reads via a path traversal flaw.","title":"Mitel MiCollab: Authentication bypass and arbitrary file read (CVE-2024-41713)","url":"https://feed.craftedsignal.io/briefs/2026-10-mitel-micollab-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MiCollab (\u003c= 9.8.1.201)","version":"https://jsonfeed.org/version/1.1"}