CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-18286
Critical (9.8) in mitel cmg suite. EPSS 2.1% chance of exploitation in the next 30 days.
SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the changepwd interface. A successful exploit could allow an attacker to extract sensitive information from the database and execute arbitrary scripts.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mitel:cmg_suite
References
- https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
- https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001
- https://www.mitel.com/-/media/mitel/pdf/security-advisories/security-bulletin-19-0003-001.pdf
- https://www.mitel.com/en-gb/support/security-advisories/mitel-product-security-adivsory-19-0003-001