Vulnerability Details : CVE-2022-45168
Potential exploit
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes before checking the TOTP.
Products affected by CVE-2022-45168
- cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-45168
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 7 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-45168
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-03-20 |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST | 2024-07-26 |
CWE ids for CVE-2022-45168
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2022-45168
-
https://www.gruppotim.it/it/footer/red-team.html
Gruppo TIM | Vulnerability Research & AdvisorExploit;Third Party Advisory
Jump to