JVN#00058727: Cybozu Remote Service Manager vulnerable to session fixation

Remote Service Manager provided by Cybozu,Inc. is a software to access on-premise systems such as Cybozu products via “Cybozu Remote Service”. Remote Service Manager contains a session fixation vulnerability.

Impact

A remote, unauthenticated attacker may impersonate a registered user. As a result, information may be disclosed or altered.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Remote Service Manager 2.3.0 and earlier
• Remote Service Manager 3.1.0 and earlier