PT-2024-11690 · Unknown · Livebox Collaboration Vdesk

Mario Cola + 2 · Published 2024-05-28 · Updated 2024-08-26 · CVE-2022-45171

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LIVEBOX Collaboration vDesk versions through v018

Description An issue allows an Unrestricted Upload of a File with a Dangerous Type under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions.

Recommendations For LIVEBOX Collaboration vDesk versions through v018, restrict access to the vShare web site section to minimize the risk of exploitation. Consider implementing file type restrictions and validation to prevent the upload of dangerous files until a fix is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-45171

Affected Products

Livebox Collaboration Vdesk

References · 4

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-45171 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45171 · Security Note
• https://t.me/cvenotify/87594 · Telegram Post