CVE-2020-11798
MEDIUM EXPLOITED NUCLEIMitel MiCollab AWV < 8.1.2.4 and 9.x < 9.1.3 - Path Traversal via Crafted URL
Title source: llmExploitation Summary
CVE-2020-11798 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Kahvi-0. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Mitel MiCollab AWV, allowing an attacker to access arbitrary files via a crafted URL. The payload targets the `/etc/passwd` file, confirming the vulnerability's effectiveness.
Description
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in Mitel MiCollab AWV, allowing an attacker to access arbitrary files via a crafted URL. The payload targets the `/etc/passwd` file, confirming the vulnerability's effectiveness.
Nuclei Templates (1)
html:"Mitel" html:"MiCollab" || http.html:"mitel" html:"micollab"
body="mitel" html:"micollab"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N