Cybozu Garoon Multiple Security Vulnerabilities
BID:108511
Info
Cybozu Garoon Multiple Security Vulnerabilities
| Bugtraq ID: | 108511 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-5928 CVE-2019-5929 CVE-2019-5930 CVE-2019-5931 CVE-2019-5932 CVE-2019-5933 CVE-2019-5934 CVE-2019-5935 CVE-2019-5936 CVE-2019-5937 CVE-2019-5938 CVE-2019-5939 CVE-2019-5940 CVE-2019-5941 CVE-2019-5942 CVE-2019-5943 CVE-2019-5944 CVE-2019-5945 CVE-2019-5946 CVE-2019-5947 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 19 2019 12:00AM |
| Updated: | Apr 19 2019 12:00AM |
| Credit: | Masato Kinugawa, Yuji Tounai, Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. , ixama, Tanghaifeng, Cybozu, Inc. |
| Vulnerable: |
Cybozu Garoon 4.10.1 Cybozu Garoon 4.6.3 Cybozu Garoon 4.6.2 Cybozu Garoon 4.6.1 Cybozu Garoon 4.2.6 Cybozu Garoon 4.2.5 Cybozu Garoon 4.2.4 Cybozu Garoon 4.2.2 Cybozu Garoon 4.2.1 Cybozu Garoon 4.0.3 Cybozu Garoon 4.0.2 Cybozu Garoon 4.0.1 Cybozu Garoon 4.6 Cybozu Garoon 4.2.3 Cybozu Garoon 4.2 Cybozu Garoon 4.10 Cybozu Garoon 4.0 |
| Not Vulnerable: |
Cybozu Garoon 4.10 Service Pack 2 |
Discussion
Cybozu Garoon Multiple Security Vulnerabilities
Cybozu Garoon is prone to the following security vulnerabilities.
1. An SQL-injection vulnerability
2. Multiple Security-bypass vulnerabilities
3. Multiple cross-site scripting vulnerabilities
4. An information-disclosure vulnerability
5. Multiple HTML-injection vulnerabilities
6. A directory-traversal vulnerability
7. An open-redirection vulnerability
Exploiting these issues may allow a remote attacker to bypass security restrictions, obtain sensitive information, redirect user to conduct phishing attacks, access or modify data, or exploit latent vulnerabilities in the underlying database, gain unauthorized access and perform certain unauthorized actions. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Cybozu Garoon is prone to the following security vulnerabilities.
1. An SQL-injection vulnerability
2. Multiple Security-bypass vulnerabilities
3. Multiple cross-site scripting vulnerabilities
4. An information-disclosure vulnerability
5. Multiple HTML-injection vulnerabilities
6. A directory-traversal vulnerability
7. An open-redirection vulnerability
Exploiting these issues may allow a remote attacker to bypass security restrictions, obtain sensitive information, redirect user to conduct phishing attacks, access or modify data, or exploit latent vulnerabilities in the underlying database, gain unauthorized access and perform certain unauthorized actions. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
Cybozu Garoon Multiple Security Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Cybozu Garoon Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Cybozu Garoon Multiple Security Vulnerabilities
References:
References:
- Cybozu Home Page (Cybozu)
- JVN#58849431: Multiple vulnerabilities in Cybozu Garoon (JP-CERT)
- Notice of Package Garoon Vulnerability (Cybozu)