CVE-2022-45175

Published: Apr 14, 2023Modified: Feb 7, 2025

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.

Affected (1)

Products: Liveboxcloud: Vdesk

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Liveboxcloud Vdesk	Up to 018

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://www.gruppotim.it/it/footer/red-team.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.gruppotim.it/it/footer/red-team.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.