JVN#81706478: Cybozu Garoon Keitai vulnerable to authentication bypass

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon Keitai contains an authentication bypass vulnerability.

Impact

When an attacker sends a specially crafted request that includes a user ID for a user that has the Keitai function enabled, authentication using Keitai may be bypassed. As a result, information that can be accessed using this user’s privileges may be disclosed.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

Products Affected

• Cybozu Garoon 3.5 through 3.7 Service Pack 2