CISA warns of critical Oracle, Mitel flaws exploited in attacks

CISA has warned U.S. federal agencies to secure their systems against critical vulnerabilities in Oracle WebLogic Server and Mitel MiCollab systems that are actively exploited in attacks.

The cybersecurity agency added a critical path traversal vulnerability (CVE-2024-41713) found in the NuPoint Unified Messaging (NPM) component Mitel's MiCollab unified communications platform to its Known Exploited Vulnerabilities Catalog.

This security bug allows attackers to perform unauthorized administrative actions and access user and network information.

"A successful exploit of this vulnerability could allow an attacker to gain unauthorized access, with potential impacts to the confidentiality, integrity, and availability of the system. This vulnerability is exploitable without authentication," MiCollab explains.

"If the vulnerability is successfully exploited, an attacker could gain unauthenticated access to provisioning information including non-sensitive user and network information and perform unauthorized administrative actions on the MiCollab Server."

The critical Oracle WebLogic Server flaw tracked as CVE-2020-2883 and patched four years ago in April 2020 enables unauthenticated attackers to take unpatched servers remotely.

The U.S. cybersecurity agency also warned of a second Mitel MiCollab path traversal vulnerability (CVE-2024-55550), enabling authenticated attackers with admin privileges to read arbitrary files on vulnerable servers. However, the impact is limited because successful exploitation doesn't allow privilege escalation, and accessible files don't contain sensitive system information.

Today, CISA added all three vulnerabilities to its Known Exploited Vulnerabilities catalog, tagging them as actively exploited. As mandated by the Binding Operational Directive (BOD) 22-01 issued in November 2021, Federal Civilian Executive Branch (FCEB) agencies must secure their networks within three weeks by January 28.

"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA said on Tuesday.

While the KEV catalog focuses on alerting U.S. federal agencies regarding vulnerabilities that should be patched as soon as possible, all organizations are advised to prioritize mitigating these security flaws to block ongoing attacks.