JVN#73182875: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains multiple vulnerabilities listed below.

SQL injection (CWE-89) - CVE-2017-2090

Access restriction flaw in the Phone Messages function (CWE-284) - CVE-2017-2091

Cross-site scripting (CWE-79) - CVE-2017-2092

Information disclosure (CWE-200) - CVE-2017-2093

Access restriction flaw in Workflow and the function “MultiReport” (CWE-284) - CVE-2017-2094

Access restriction flaw in the mail function (CWE-284) - CVE-2017-2095

Impact

• A user may execute arbitrary SQL commands - CVE-2017-2090
• A user may set uncofirmed phone messages to be displayed as if they have already been confirmed - CVE-2017-2091
• Arbitrary scripts may be executed on the logged-in user’s web browser - CVE-2017-2092
• Token used for cross-site request forgery (CSRF) protection may be disclosed - CVE-2017-2093
• A user may alter or delete information of Workflow and the multi report function, which the user does not have permission to access - CVE-2017-2094
• A user may alter the order of the mail folders - CVE-2017-2095

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Cybozu Garoon 3.0.0 to 4.2.3