Lucene search

MitreCVE-2022-45174

HistoryApr 14, 2023 - 2:15 p.m.

CVE-2022-45174

2023-04-1414:15:10

CWE-287

mitre

web.nvd.nist.gov

cve-2022-45174

livebox collaboration

vdesk

two-factor authentication

saml

bypass

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.

Affected configurations

Nvd

Node

liveboxcloudvdeskRange≤018

VendorProductVersionCPE
liveboxcloudvdesk*cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
liveboxcloud	vdesk	*	cpe:2.3:a:liveboxcloud:vdesk::::::::

References

www.gruppotim.it/it/footer/red-team.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

Related for CVE-2022-45174