Lucene search

K
jvnJapan Vulnerability NotesJVN:79854355
HistoryDec 17, 2019 - 12:00 a.m.

JVN#79854355: Multiple vulnerabilities in Cybozu Office

2019-12-1700:00:00
Japan Vulnerability Notes
jvn.jp
47

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

42.9%

Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below.

Directory traversal in the “Customapp” function (CWE-22) - CVE-2019-6022

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Base Score: 7.7
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Browse restriction bypass in the application “Address” (CWE-284) - CVE-2019-6023

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

Impact

  • A user who can use “Customapp” function may alter arbitrary files on the server - CVE-2019-6022
  • A user who can login to the product may obtain data without access privileges - CVE-2019-6023

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

  • Cybozu Office 10.0.0 to 10.8.3

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

42.9%

Related for JVN:79854355