US security agency warns of attacks on MiCollab and WebLogic Server
Admins should equip their systems with Mitel and Oracle software against current attacks.
(Image: vectorfusionart/Shutterstock.com)
Attackers are currently targeting PCs on which Mitel MiColab or Oracle WebLogic Server is installed. In the worst case, attackers can take over systems completely. Security patches are available for download. The extent of the attacks is currently unknown.
The security vulnerabilities
According to a warning from the US security authority CISA, two vulnerabilities (CVE-2024-41713 MiColab, CVE-2020-2883 WebLogicServer) are classified as “critical”.
Videos by heise
Another vulnerability (CVE-2024-55550) is only rated “medium”, but security researchers watchTowr Labs describe in a paper that attackers can combine vulnerabilities to view files on servers.
Secured issues
In a warning message, Mitel states that MiCollab 9.8 SP2 (9.8.2.12) is protected against the aforementioned combination attack.
If attacks on Oracle WebLogic Server are successful, attackers can compromise systems. What this could look like in detail is not yet known. Specifically, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0 are at risk. Admins should ensure that the latest versions are installed.
(des)
