CVE-2022-45179

Name
CVE-2022-45179
Description
An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter and /dashboard/reminders. A remote user (authenticated to the product) can store arbitrary HTML code in the reminder section title in order to corrupt the web page (for example, by creating phishing sections to exfiltrate victims' credentials).
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://www.gruppotim.it/it/footer/red-team.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:* vdesk >= None <= v031
cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:* vdesk >= None <= 031

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
vdesk edge-community 1.2-r1 ScrumpyJack <scrumpyjack@st.ilet.to> possibly vulnerable
vdesk 3.19-community 1.2-r1 ScrumpyJack <scrumpyjack@st.ilet.to> possibly vulnerable