medium6.5
CVE-2022-45175
An issue was discovered in LIVEBOX Collaboration vDesk through v018.
Impact
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Liveboxcloud | Vdesk | through 018 |