CVE-2022-45175

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p52

Published

Apr 14, 2023 (Apr 14, 2023)

Modified

Jun 17, 2026

Description

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.

Vendors: liveboxcloud
Products: vdesk
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.