CVE-2022-45175: 
Linux Alpine vulnerability analysis and mitigation

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference (IDOR) vulnerability exists under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. This vulnerability allows a malicious unauthenticated user to access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file (MITRE).

The vulnerability is classified as an Authorization Bypass Through User-Controlled Key (CWE-639). It has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability affects the websocket endpoint and allows unauthorized access to cached files through file ID guessing (NVD).

The vulnerability allows unauthorized access to cached files in the OnlyOffice backend, potentially exposing sensitive information of other users. The high confidentiality impact (C:H) in the CVSS score indicates that the vulnerability can lead to total information disclosure, with all system files being revealed (NVD).

Users should upgrade to a version newer than v018 of LIVEBOX Collaboration vDesk. No specific workarounds have been publicly documented (NVD).