Lucene search

Japan Vulnerability NotesJVN:14658424

HistoryOct 11, 2017 - 12:00 a.m.

JVN#14658424: Cybozu Office fails to restrict access permissions

2017-10-1100:00:00

Japan Vulnerability Notes

jvn.jp

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.6%

JSON

Cybozu Office provided by Cybozu, Inc. fails to restrict access permissions (CWE-284) due to an issue in “Cabinet” function.

Impact

A user who can login to Cybozu Office may perform arbitrary operations to the folder where the user does not have acces with its privilege.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

Cybozu Office 10.0.0 to 10.6.1

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

21.6%

JSON

Related for JVN:14658424