An issue exists in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. This push notification can include an (invisible) clickable link.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
liveboxcloud vdesk |
Vulmon