JVN#83428818 La!cooda WIZ and LacoodaST vulnerable to cross-site request forgery

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a cross-site request forgery vulnerability.

Impact

Password or other configurations may be changed if the logged in user views a malicious web page.

Solution

Update the Software
Apply the latest updates provided by the vendors.
For more information, refer to the vendors’ websites.

Products Affected

• La!cooda WIZ 1.4.0 and earlier
• LacoodaST 2.1.3 and earlier
  For more information, refer to the vendors’ websites.