CVE-2022-45180

Published Apr 14, 2023

Last updated 2 years ago

CVSS medium 6.5

Overview

Description: An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system (an operation intended to only be available to the system administrator).
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "59F30C76-FDF5-4D2E-A3CE-33EAB97AB650",
            "versionEndIncluding": "018"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References