Mitel MiContact Center Business Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the legacy chat component of Mitel MiContact Center Business, affecting versions through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4. This vulnerability allows an unauthenticated attacker to conduct a reflected XSS attack due to insufficient input validation. Exploitation requires user interaction and could enable the execution of arbitrary scripts, with a limited impact on confidentiality and integrity.

Impact

Exploitation allows for reflected cross-site scripting, where an attacker can execute scripts in the context of the user's browser session.

Remediation

Users are advised to upgrade to MiContact Center Business version 10.2.0.5 or later. Hotfixes KB571322, KB571372, and KB571320 are also available for versions 10.1.0.5, 10.0.0.4, and 9.5.0.3, respectively. For more information, consult the Mitel Knowledge Base article SO8420 or contact a Mitel Authorized Partner.