CVE-2020-25608: 
Mitel MiCollab vulnerability analysis and mitigation

The SAS portal of Mitel MiCollab before version 9.2 contains a SQL Injection vulnerability (CVE-2020-25608) due to improper input validation. This vulnerability was disclosed in December 2020 and affects the user authentication functionality of the system (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The CVSS v2.0 score is 6.5 (MEDIUM) with vector (AV:N/AC:L/Au:S/C:P/I:P/A:P). The vulnerability stems from improper input validation in the SAS portal component, which could allow SQL injection attacks (NVD).

If exploited, this vulnerability could allow an attacker to access user credentials through SQL injection techniques. The high CVSS score indicates potential for significant impact on the confidentiality, integrity, and availability of the system (NVD, CERT-FR).

The vulnerability requires network access and high privileges for exploitation, but has low attack complexity. It can be exploited remotely without requiring user interaction (NVD).

The recommended mitigation is to upgrade MiCollab to version 9.2 or later. Mitel has released patches to address this vulnerability (Mitel Advisory).