Vulnerability · Published Jan 31, 2023 · Assigned by mitre
CVE-2022-45172
Critical 9.8
In plain English
A critical-severity incorrect authorization in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected by flaws in authorization logic, through which a malicious user (with no privileges) is able to perform privilege escalation to the administrator role, and steal the accounts of any users on the system.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H