CVE-2022-45174

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.03% chance of exploitation in the next 30 days, 61th percentile

Published

2023-04-14

Updated

2025-02-07

Proof-of-concept exploits (1)

• https://www.gruppotim.it/it/footer/red-team.html

References

• CVE Record
• NVD entry

Related

• CVE-2022-45173
• CVE-2022-45175
• CVE-2022-45172
• CVE-2022-45176
• CVE-2022-45171
• CVE-2022-45178