CVE-2024-55550

LowCVSS 2.7/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosure is limited to non-sensitive system information. This vulnerability does not allow file modification or privilege escalation.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Dec 10, 2024
Last modified
Aug 4, 2026
Added to CISA KEV
Jan 7, 2025
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-555518.3An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggCVE-2024-555537.5In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the inteCVE-2024-555545.4Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.CVE-2024-555558.8Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY. This is exacerbCVE-2024-555569.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on thCVE-2024-555579.8ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.CVE-2024-55568.8Zohocorp ManageEngine ADAudit Plus versions below 8000 are vulnerable to the authenticated SQL injection in reports module.CVE-2024-555609.8MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installatioCVE-2024-555635.3Bitcoin Core through 27.2 allows transaction-relay jamming via an off-chain protocol attack, a related issue to CVE-2024-52913. For example,CVE-2024-555649.8The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.CVE-2024-555654.3nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.CVE-2024-555666.6ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG). The impact ca