CVE-2022-45178
CVE-2022-45178 is a high-severity vulnerability in Liveboxcloud Vdesk with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 8.8)
- EPSS exploit prediction: 1% (57th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Liveboxcloud Vdesk
- Published:
- Last modified:
Description
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.
Frequently asked questions
- What is CVE-2022-45178?
- An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.
- How severe is CVE-2022-45178?
- CVE-2022-45178 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2022-45178 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-45178?
- CVE-2022-45178 affects Liveboxcloud Vdesk. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-45178?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2022-45178 published?
- CVE-2022-45178 was published on 2023-04-14 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:liveboxcloud:vdesk:*:*:*:*:*:*:*:*
More vulnerabilities in Liveboxcloud Vdesk
- CVE-2022-45174 — Critical (CVSS 9.8): An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML…
- CVE-2022-45173 — Critical (CVSS 9.8): An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur…
- CVE-2022-45172 — Critical (CVSS 9.8): An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the…
- CVE-2022-45171 — High (CVSS 8.8): An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous…
- CVE-2022-45177 — High (CVSS 7.5): An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under…
- CVE-2022-45168 — Medium (CVSS 6.5): An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur…