CVE-2024-39457

2024-07-1908:36:27

jpcert

github.com

cybozu garoon 6.0.0

6.0.1

cross-site scripting

pdf preview

arbitrary script execution

logged-in user

web browser

AI Score

6.2

Confidence

High

EPSS

Percentile

14.7%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser.

CNA Affected

[
  {
    "vendor": "Cybozu, Inc.",
    "product": "Cybozu Garoon",
    "versions": [
      {
        "status": "affected",
        "version": "6.0.0 to 6.0.1"
      }
    ]
  }
]