CVE-2022-45177 Information disclosure in n/a
An attacker can reveal internal state information via response discrepancies in specific API endpoints of LIVEBOX Collaboration vDesk.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45177?
CVE-2022-45177 is a high-severity vulnerability in n/a, published on 21 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isenableuser endpoint, the /api/v1/sharedsearch?search={NAME]+{SURNAME] endpoint, and the /login endpoint. The web application provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Which versions are affected by CVE-2022-45177?
It affects 1 product.
Products include Liveboxcloud Vdesk.
How do I fix CVE-2022-45177?
No fix has been published for CVE-2022-45177 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-45177 being exploited?
There is no known exploitation of CVE-2022-45177 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g759-2x5w-f89c.