CVE-2022-45169

Published: Feb 21, 2024Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. This push notification can include an (invisible) clickable link.

Affected (1)

Products: Liveboxcloud: Vdesk

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Liveboxcloud Vdesk	Up to 031

Related CWEs

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (2)

https://www.gruppotim.it/it/footer/red-team.html

Source: cve@mitre.org

Third Party Advisory

https://www.gruppotim.it/it/footer/red-team.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.