Cybozu Garoon CVE-2013-0702 Unspecified Cross Site Scripting Vulnerabilitiy

Bugtraq ID:	57871
Class:	Input Validation Error
CVE:	CVE-2013-0702
Remote:	Yes
Local:	No
Published:	Feb 08 2013 12:00AM
Updated:	Feb 08 2013 12:00AM
Credit:	Ken Asai
Vulnerable:	Cybozu Garoon 2.1.3 Cybozu Garoon 2.1.1 Cybozu Garoon 2.1 Cybozu Garoon 2.5.0 Cybozu Garoon 2.0.0
Not Vulnerable:

Cybozu Garoon CVE-2013-0702 Unspecified Cross Site Scripting Vulnerabilitiy

Cybozu Garoon is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Cybozu Garoon versions 2.0.0 through 3.5.3 are vulnerable.

Cybozu Garoon CVE-2013-0702 Unspecified Cross Site Scripting Vulnerabilitiy

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Cybozu Garoon CVE-2013-0702 Unspecified Cross Site Scripting Vulnerabilitiy

Solution:
Updates are available. Please see the references for more information.

Cybozu Garoon CVE-2013-0702 Unspecified Cross Site Scripting Vulnerabilitiy

References:

• Cybozu Garoon Download page (Cybozu)