CISA

CISA warns of critical Oracle, Mitel flaws exploited in attacks

Share:

CISA has warned U.S. federal agencies to secure their systems against critical vulnerabilities in Oracle WebLogic Server and Mitel MiCollab systems that are actively exploited in attacks.

The cybersecurity agency added a critical path traversal vulnerability (CVE-2024-41713) found in the NuPoint Unified Messaging (NPM) component Mitel’s MiCollab unified communications platform to its Known Exploited Vulnerabilities Catalog.

This security bug allows attackers to perform unauthorized administrative actions and access user and network information.

“A successful exploit of this vulnerability could allow an attacker to gain unauthorized access, with potential impacts to the confidentiality, integrity, and availability of the system. This vulnerability is exploitable without authentication,” MiCollab explains.

“If the vulnerability is successfully exploited, an attacker could gain unauthenticated access to provisioning information including non-sensitive user and network information and perform unauthorized administrative actions on the MiCollab Server.”

The critical Oracle WebLogic Server flaw tracked as CVE-2020-2883 and patched four years ago in April 2020 enables unauthenticated attackers to take unpatched servers remotely.

The U.S. cybersecurity agency also warned of a second Mitel MiCollab path traversal vulnerability (CVE-2024-55550), enabling authenticated attackers with admin privileges to read arbitrary files on vulnerable servers. However, the impact is limited because successful exploitation doesn’t allow privilege escalation, and accessible files don’t contain sensitive system information.

Today, CISA added all three vulnerabilities to its Known Exploited Vulnerabilities catalog, tagging them as actively exploited. As mandated by the Binding Operational Directive (BOD) 22-01 issued in November 2021, Federal Civilian Executive Branch (FCEB) agencies must secure their networks within three weeks by January 28.

“These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” CISA said on Tuesday.

While the KEV catalog focuses on alerting U.S. federal agencies regarding vulnerabilities that should be patched as soon as possible, all organizations are advised to prioritize mitigating these security flaws to block ongoing attacks.

Source

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
5:03 pm, Feb 15, 2025
weather icon 5°C
L: 4° | H: 6°
light rain
Humidity: 82 %
Pressure: 1019 mb
Wind: 2 mph E
Wind Gust: 6 mph
UV Index: 0
Precipitation: 0.25 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 9 km
Sunrise: 7:14 am
Sunset: 5:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
4° | 6°°C 1 mm 100% 6 mph 86 % 1020 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
2° | 5°°C 0.79 mm 79% 9 mph 95 % 1022 mb 0 mm/h
Mon Feb 17 9:00 pm
weather icon
1° | 7°°C 0 mm 0% 7 mph 77 % 1022 mb 0 mm/h
Tue Feb 18 9:00 pm
weather icon
3° | 9°°C 0 mm 0% 9 mph 73 % 1021 mb 0 mm/h
Wed Feb 19 9:00 pm
weather icon
5° | 11°°C 0 mm 0% 8 mph 94 % 1019 mb 0 mm/h
Today 6:00 pm
weather icon
3° | 5°°C 1 mm 100% 6 mph 82 % 1020 mb 0 mm/h
Today 9:00 pm
weather icon
2° | 4°°C 1 mm 100% 6 mph 86 % 1020 mb 0 mm/h
Tomorrow 12:00 am
weather icon
2° | 3°°C 0.79 mm 79% 6 mph 90 % 1020 mb 0 mm/h
Tomorrow 3:00 am
weather icon
2° | 2°°C 0 mm 0% 5 mph 95 % 1020 mb 0 mm/h
Tomorrow 6:00 am
weather icon
3° | 3°°C 0 mm 0% 7 mph 88 % 1020 mb 0 mm/h
Tomorrow 9:00 am
weather icon
3° | 3°°C 0 mm 0% 7 mph 85 % 1021 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
5° | 5°°C 0 mm 0% 9 mph 65 % 1021 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
5° | 5°°C 0 mm 0% 8 mph 62 % 1021 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,932.18
-0.24%
Ethereum(ETH)
€2,560.89
-2.33%
XRP(XRP)
€2.64
1.02%
Tether(USDT)
€0.95
0.00%
Solana(SOL)
€185.16
-3.83%
USDC(USDC)
€0.95
0.02%
Dogecoin(DOGE)
€0.260169
-0.65%
Shiba Inu(SHIB)
€0.000015
-3.21%
Pepe(PEPE)
€0.000010
-5.15%
Scroll to Top