Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
jvnJapan Vulnerability NotesJVN:58849431
HistoryApr 25, 2019 - 12:00 a.m.

JVN#58849431: Multiple vulnerabilities in Cybozu Garoon

2019-04-2500:00:00
Japan Vulnerability Notes
jvn.jp
61

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

0.013 Low

EPSS

Percentile

85.8%

JSON

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below.

Cross-site scripting in the additional processing of Customize Item function (CWE-79) - CVE-2019-5928

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

Cross-site scripting in the application “Memo” (CWE-79) - CVE-2019-5929

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:L/Au:N/C:N/I:P/A:N Base Score: 5.0

Browse restriction bypass in the application “Management of Basic System” (CWE-264) - CVE-2019-5930

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

Improper verification of file path in installer (CWE-20) - CVE-2019-5931

Version Vector Score
CVSS v3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Base Score: 6.0
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:P Base Score: 4.9

Stored cross-site scripting in the application “Portal” (CWE-79) - CVE-2019-5932

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Base Score: 4.8
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

Browse restriction bypass in the application “Bulletin” (CWE-284) - CVE-2019-5933

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:M/Au:S/C:P/I:N/A:N Base Score: 3.5

SQL injection in the Log Search function of application “logging” (CWE-89) - CVE-2019-5934

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L Base Score: 6.0
CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:P Base Score: 6.5

Operation restriction bypass in the Item function of User Information (CWE-264) - CVE-2019-5935

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Directory traversal in the application “Work Flow” (CWE-22) - CVE-2019-5936

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:N Base Score: 5.5

Cross-site scripting in the user information (CWE-79) - CVE-2019-5937

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

Stored cross-site scripting in the application “Mail” (CWE-79) - CVE-2019-5938

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3

Cross-site scripting in the application “Portal” (CWE-79) - CVE-2019-5939

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

Cross-site scripting in the application “Scheduler” (CWE-79) - CVE-2019-5940

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

Operation restriction bypass in the application “Multi Report” (CWE-264) - CVE-2019-5941

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Browse restriction bypass in the Multiple Files Download function of application “Cabinet” (CWE-284) - CVE-2019-5942

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

Browse restriction bypass in the application “Bulletin” and the application “Cabinet” (CWE-284) - CVE-2019-5943

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

Operation restriction bypass in the application “Address” (CWE-264) - CVE-2019-5944

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Information disclosure in the authentication of Cybozu Garoon (CWE-287) - CVE-2019-5945

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Base Score: 5.3
CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N Base Score: 4.3

Open redirect in the Login Screen (CWE-601) - CVE-2019-5946

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Base Score: 7.4
CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N Base Score: 4.3

Cross-site scripting in the application “Cabinet” (CWE-79) - CVE-2019-5947

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Server-side request forgery in the V-CUBE Meeting function (CWE-918) - CVE-2020-5562

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N Base Score: 6.8
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

Impact

  • An arbitrary script may be executed on a user’s web browser. - CVE-2019-5929
  • An arbitrary script may be executed on a logged in user’s web browser. - CVE-2019-5928, CVE-2019-5932, CVE-2019-5937, CVE-2019-5938, CVE-2019-5939, CVE-2019-5940, CVE-2019-5947
  • A user, who can login to the product, may view the information without view privileges. - CVE-2019-5930, CVE-2019-5943
  • Information may be altered with the privilege of the user invoking the installer. - CVE-2019-5931
  • A user, who can login to the product, may view the Bulletin Board without view privileges. - CVE-2019-5933
  • A user, who can access to the product with administrative privileges, may execute an arbitrary SQL commands. - CVE-2019-5934
  • A remote attacker may change user information without access privileges. - CVE-2019-5935
  • A user, who can login to the product, may obtain file without access privileges. - CVE-2019-5936, CVE-2019-5942
  • A user, who can login to the product, may alter the Report without access privileges. - CVE-2019-5941
  • A user, who can login to the product, may alter the contents of application “Address” without modify privileges. - CVE-2019-5944
  • Users’ credential information may be disclosed. - CVE-2019-5945
  • When accessing a specially crafted URL, a user may be redirected to an arbitrary website. - CVE-2019-5946
  • A user who can login to the product with an administrative privilege may issue arbitrary HTTP requests to other web servers from the product - CVE-2020-5562

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

CVE-2019-5928 to CVE-2019-5931

  • Cybozu Garoon 4.0.0 to 4.6.3
    CVE-2019-5932 and CVE-2020-5562

  • Cybozu Garoon 4.6.0 to 4.6.3
    CVE-2019-5933 and CVE-2019-5934

  • Cybozu Garoon 4.0.0 to 4.10.0
    CVE-2019-5935 to CVE-2019-5944

  • Cybozu Garoon 4.0.0 to 4.10.1
    CVE-2019-5945 and CVE-2019-5946

  • Cybozu Garoon 4.2.4 to 4.10.1
    CVE-2019-5947

  • Cybozu Garoon 4.6.0 to 4.10.1

Related

openvas 6
cve 21
cvelist 21
prion 21
nvd 21
openvas
openvas
Cybozu Garoon 4.x.x <= 4.10.1 Multiple Vulnerabilities
2019-05-29 00:00:00
Cybozu Garron 4.x <= 4.6.3 Multiple Vulnerabilities
2019-05-27 00:00:00
Cybozu Garoon >= 4.2.4, <= 4.10.1 Multiple Vulnerabilities
2019-05-29 00:00:00
cve
cve
CVE-2019-5941
2019-05-17 16:29:04
CVE-2019-5945
2019-05-17 16:29:05
CVE-2019-5944
2019-05-17 16:29:05
cvelist
cvelist
CVE-2019-5941
2019-05-17 15:25:55
CVE-2019-5945
2019-05-17 15:25:55
CVE-2019-5930
2019-05-17 15:25:54
prion
prion
Authentication flaw
2019-05-17 16:29:00
Cross site scripting
2019-05-17 16:29:00
Authentication flaw
2019-05-17 16:29:00
nvd
nvd
CVE-2019-5945
2019-05-17 16:29:05
CVE-2019-5932
2019-05-17 16:29:03
CVE-2019-5940
2019-05-17 16:29:04

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

0.013 Low

EPSS

Percentile

85.8%

JSON
Related for JVN:58849431
openvas6cve21cvelist21prion21nvd21