JVN#18700809 Cybozu Garoon session fixation vulnerability

Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the attacker.

Impact

A remote attacker impersonating a logged in user may execute arbitrary code with the privilege of the user. As a result, disclosure or alteration of information may occur.

Solution

Update the Software
Apply the latest update provided by the vendor.

Products Affected

• Cybozu Garoon version 2.0.0 - 2.1.3