CoreCVE
Back

CRITICAL

An issue was discovered in LIVEBOX Collaboration vDesk through v018

Published Apr 14, 2023

Description

An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner mitre
Published Apr 14, 2023
Updated Feb 7, 2025
Reserved Nov 11, 2022
Link CVE-2022-45174

CISA Vulnrichment

Updated Feb 7, 2025

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2022-45174

Red Hat

No data

ENISA EUVD

Assigner mitre
Published Apr 14, 2023
Updated Feb 7, 2025
Link EUVD-2022-48082

GitHub

No data