CVE-2022-45179

An issue was discovered in LIVEBOX Collaboration vDesk through v031

Medium · published February 21, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter and /dashboard/reminders. A remote user (authenticated to the product) can store arbitrary HTML code in the reminder section title in order to corrupt the web page (for example, by creating phishing sections to exfiltrate victims' credentials).

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Published
2024-02-21T00:00Z
EPSS history
Timeline
  • 21 FEB 00:00Z
    An issue was discovered in LIVEBOX Collaboration vDesk through v031
    cvelistv5