Cybozu Multiple Products Unspecified Cross Site Scripting Vulnerabilities

Bugtraq ID:	36704
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 13 2009 12:00AM
Updated:	Oct 17 2009 12:08AM
Credit:	Takeshi Terada
Vulnerable:	Cybozu Office 7 Cybozu Mailwise 3 Cybozu Dezie 6
Not Vulnerable:	Cybozu Office 8 Cybozu Mailwise 4 Cybozu Dezie 7

Cybozu Multiple Products Unspecified Cross Site Scripting Vulnerabilities

Multiple Cybozu products are prone to multiple cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied input.

Very few details are available. We will update this BID as more information emerges.

The following products are affected:

Cybozu Mailwise 3
Cybozu Dezie 6
Cybozu Office 7

Cybozu Multiple Products Unspecified Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Cybozu Multiple Products Unspecified Cross Site Scripting Vulnerabilities

Solution:
Updates are available; please see the references for details.

Cybozu Multiple Products Unspecified Cross Site Scripting Vulnerabilities

References:

• Cybozu Home Page (Cybozu)
  
• JVN#23108985 Multiple Cybozu products vulnerable to cross-site scripting (JVN)
  
• Cross-site scripting vulnerability [CY09-10-001] (Cybozu)