JVN#13218253: Cybozu Garoon vulnerable to information disclosure

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an information disclosure vulnerability (CWE-200).

Impact

Cybozu Garoon uses HTTPS communication, therefore an attacker can not eavesdrop on communication under normal operations. However, if a user conducts a specific operation while an attacker eavesdrops on communication in some way, the attacker may be able to obtain a token issued against CSRF attack.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Cybozu Garoon 3.0.0 to 4.2.2