Cybozu Office for Mobile CVE-2013-3269 Cross-Site Request Forgery Vulnerability

Bugtraq ID:	59502
Class:	Input Validation Error
CVE:	CVE-2013-3269
Remote:	Yes
Local:	No
Published:	Apr 15 2013 12:00AM
Updated:	Apr 15 2013 12:00AM
Credit:	Reported by the vendor
Vulnerable:	Cybozu Office for Mobile 9 Cybozu Office for Mobile 8
Not Vulnerable:	Cybozu Office for Mobile 9.3 Cybozu Office for Mobile 8.1.6

Cybozu Office for Mobile CVE-2013-3269 Cross-Site Request Forgery Vulnerability

Cybozu Office for Mobile is prone a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Note: This issue was previously discussed in BID 59062 (Multiple Cybozu Products Cross-Site Request Forgery Vulnerability), but has been moved to its own record for better documentation.

Cybozu Office for Mobile prior to 8.1.6 and 9.3.0 are vulnerable.

Cybozu Office for Mobile CVE-2013-3269 Cross-Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to follow a malicious URI.

Cybozu Office for Mobile CVE-2013-3269 Cross-Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cybozu Office for Mobile CVE-2013-3269 Cross-Site Request Forgery Vulnerability

References:

• Cybozu Homepage (Cybozu)
  
• [CY13-004-002] Vulnerability mobile password of the currently logged in user wil (Cybozu)