CVE-2022-45176: 
Linux Alpine vulnerability analysis and mitigation

An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application (through its vShare functionality section) doesn't properly check parameters, sent in HTTP requests as input, before saving them on the server. In addition, crafted JavaScript content can then be reflected back to the end user and executed by the web browser (NVD).

The vulnerability is classified as a Stored Cross-site Scripting (XSS) issue (CWE-79: Improper Neutralization of Input During Web Page Generation). The flaw exists in the vShare functionality section where parameters sent in HTTP requests are not properly validated before being stored on the server. The vulnerability specifically affects the /api/v1/getbodyfile endpoint through the uri parameter. According to the CVSS 3.1 scoring, it has received a base score of 5.4 (MEDIUM) with the vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, the vulnerability allows attackers to store malicious JavaScript code on the server, which is then executed when other users access the affected pages. This can lead to unauthorized access to user data, session hijacking, or other malicious actions performed in the context of the victim's browser session (NVD).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack complexity is considered low, indicating that the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability affects LIVEBOX Collaboration vDesk through version 018. Users should update to a newer version if available. In the absence of a patch, implementing proper input validation and output encoding for user-supplied content can help mitigate the risk (NVD).