CVE-2022-45174

2023-04-1400:00:00

mitre

www.cve.org

livebox collaboration

vdesk

v018

two-factor authentication

bypass

saml users

totp

backup code

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

66.1%

JSON

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.

References

www.gruppotim.it/it/footer/red-team.html