PT-2024-11689 · Unknown · Livebox Collaboration Vdesk

Andrea Carlo Maria Dattola + 2 · Published 2024-02-21 · Updated 2024-10-30 · CVE-2022-45169

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LIVEBOX Collaboration vDesk versions through v031

Description An issue was discovered allowing a URL Redirection to an Untrusted Site (Open Redirect) under the "/api/v1/notification/createnotification" endpoint. This enables an authenticated user to send an arbitrary push notification to any other user of the system, which can include an invisible clickable link.

Recommendations For versions through v031, as a temporary workaround, consider restricting access to the "/api/v1/notification/createnotification" endpoint until a patch is available. Additionally, limiting the ability to send push notifications to only trusted users may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-45169

Affected Products

Livebox Collaboration Vdesk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-45169 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45169 · Vendor Advisory
• https://t.me/cvenotify/100025 · Telegram Post
• https://twitter.com/CVEnew/status/1760331664889114956 · Twitter Post
• https://gruppotim.it/it/footer/red-team.html · Note
• https://t.me/cvenotify/72105 · Telegram Post
• https://t.me/cvenotify/74264 · Telegram Post