Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
BID:48446
Info
Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 48446 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-1333 CVE-2011-1334 CVE-2011-1335 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 24 2011 12:00AM |
| Updated: | Jun 24 2011 12:00AM |
| Credit: | Sen UENO of Tricorder Co. Ltd. and NetAgent Co. Ltd. |
| Vulnerable: |
Cybozu Office 8 Cybozu Office 7 Cybozu Office 6 Cybozu Mailwise 3 Cybozu Garoon 2.1.3 Cybozu Garoon 2.1.1 Cybozu Garoon 2.1 Cybozu Garoon 2.0.0 Cybozu Dezie 6 Cybozu Collaborex 1.4 |
| Not Vulnerable: |
Cybozu Office 8.1.1 Cybozu Mailwise 3.1 Cybozu Garoon 2.5.0 Cybozu Dezie 6.1 Cybozu Collaborex 1.5 |
Discussion
Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
Multiple Cybozu products are prone to multiple cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
The following products are affected:
Cybozu Office 6, 7 and 8.x versions prior to 8.1.1
Cybozu Gallon versions 2.0.0 to 2.1.3
Cybozu Collaborex versions prior to 1.5
Cybozu Dezie versions prior to 6.1
Cybozu Mailwise versions prior to 3.1
Multiple Cybozu products are prone to multiple cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
The following products are affected:
Cybozu Office 6, 7 and 8.x versions prior to 8.1.1
Cybozu Gallon versions 2.0.0 to 2.1.3
Cybozu Collaborex versions prior to 1.5
Cybozu Dezie versions prior to 6.1
Cybozu Mailwise versions prior to 3.1
Exploit / POC
Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
Solution:
Updates are available; please see the references for details.
Solution:
Updates are available; please see the references for details.
References
Multiple Cybozu Products Multiple Cross Site Scripting Vulnerabilities
References:
References:
- Home Page (Cybozu)
- Cybozu Fixes (Cybozu)
- Cybozu Fixes (Cybozu)
- JVN#54074460 Multiple Cybozu products vulnerable to cross-site scripting (CERT)
- JVN#55508059 Cybozu Office vulnerable to cross-site scripting (CERT)
- JVN#80877328 Multiple Cybozu products vulnerable to cross-site scripting (CERT)
- JVNDB-2011-000045 Multiple Cybozu products vulnerable to cross-site scripting (CERT)
- JVNDB-2011-000046 Multiple Cybozu products vulnerable to cross-site scripting (CERT)
- JVNDB-2011-000047 Cybozu Office vulnerable to cross-site scripting (CERT)