CVE-2024-39817

2024-08-0604:54:50

jpcert

github.com

cybozu office

data issue

custom app

information security

cve-2024-39817

AI Score

6.4

Confidence

Low

EPSS

0.001

Percentile

18.9%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting ‘search’ under certain conditions in Custom App.

CNA Affected

[
  {
    "vendor": "Cybozu, Inc.",
    "product": "Cybozu Office",
    "versions": [
      {
        "version": "10.0.0 to 10.8.6",
        "status": "affected"
      }
    ]
  }
]