JVN#52694228: Multiple vulnerabilities in Cybozu Remote Service

Cybozu Remote Service provided by Cybozu, Inc. contains multiple vulnerabilities listed below.

[CyVDB-525] Cross-site request forgery vulnerability in the management screen (CWE-352) - CVE-2021-20795

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	Base Score: 6.5
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

[CyVDB-1742] Path traversal vulnerability in the management screen (CWE-22) - CVE-2021-20796

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L	Base Score: 4.2
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:P	Base Score: 4.9

[CyVDB-1806] Cross-site script inclusion vulnerability in the management screen (CWE-829) - CVE-2021-20797

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:H/Au:S/C:N/I:P/A:N	Base Score: 2.1

[CyVDB-1808] Cross-site scripting vulnerability in the management screen (CWE-79) - CVE-2021-20798

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

[CyVDB-1809] Cross-site scripting vulnerability in the management screen (CWE-79) - CVE-2021-20799

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

[CyVDB-1810] Cross-site scripting vulnerability in the management screen (CWE-79) - CVE-2021-20800

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

[CyVDB-1811] XML external entity injection (XXE) vulnerability (CWE-611) - CVE-2021-20801

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:L/Au:S/C:P/I:N/A:N	Base Score: 4.0

[CyVDB-1814] HTTP header injection vulnerability (CWE-113) - CVE-2021-20802

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

[CyVDB-1820] Operation restriction bypass in the management screen (CWE-264) - CVE-2021-20803

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	Base Score: 5.4
CVSS v2	AV:N/AC:L/Au:S/C:N/I:P/A:P	Base Score: 5.5

[CyVDB-1830] Denial-of-service (DoS) vulnerability (CWE-400) - CVE-2021-20804

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H	Base Score: 5.3
CVSS v2	AV:N/AC:M/Au:S/C:N/I:N/A:C	Base Score: 6.3

[CyVDB-1862] Cross-site scripting vulnerability in the management screen (CWE-79) - CVE-2021-20805

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	Base Score: 5.4
CVSS v2	AV:N/AC:M/Au:S/C:N/I:P/A:N	Base Score: 3.5

[CyVDB-1968] Open redirect vulnerability (CWE-601) - CVE-2021-20806

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N	Base Score: 3.4
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

[CyVDB-2028] Cross-site scripting vulnerability in the management screen (CWE-79) - CVE-2021-20807

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	Base Score: 6.1
CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

[CyVDB-877] Path traversal vulnerability in Importing Mobile Device Data (CWE-22) - CVE-2022-26838

Version	Vector	Score
CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L	Base Score: 4.3
CVSS v2	AV:N/AC:L/Au:S/C:N/I:N/A:P	Base Score: 5.0

Impact

• [CyVDB-525]:
  If a user views a malicious page while logged in, unintended operations may be performed.
• [CyVDB-1742]:
  A user who can log in to the product may upload an arbitrary file.
• [CyVDB-1806], [CyVDB-1811]:
  A user who can log in to the product may obtain the information stored in the product. Note that [CyVDB-1806] issue only occurs when using Mozilla firefox.
• [CyVDB-1808], [CyVDB-1809], [CyVDB-1810], [CyVDB-1862], [CyVDB-2028]:
  An arbitrary script may be executed on a logged-in user’s web browser.
• [CyVDB-1814]:
  A remote attacker may alter the information stored in the product.
• [CyVDB-1820]:
  A user who can log in to the product may alter the data of the management screen.
• [CyVDB-1830], [CyVDB-877]:
  A user who can log in to the product may be able to cause a denial-of-service (DoS) condition.
• [CyVDB-1968]:
  When accessing a specially crafted URL, the user may be redirected to an arbitrary website.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

CVE-2021-20795, CVE-2021-20798, CVE-2021-20799, CVE-2021-20801, CVE-2021-20802, CVE-2021-20803, CVE-2021-20804

• Cybozu Remote Service 3.1.8 to 3.1.9
  CVE-2021-20796, CVE-2021-20797, CVE-2021-20800

• Cybozu Remote Service 3.1.8
  CVE-2021-20805

• Cybozu Remote Service 3.1.7 to 3.1.9
  CVE-2021-20806, CVE-2021-20807

• Cybozu Remote Service 3.0.0 to 3.1.9
  CVE-2022-26838

• Cybozu Remote Service 3.1.2