Cybozu Garoon API Appointment Security Bypass Vulnerability

Bugtraq ID:	67257
Class:	Access Validation Error
CVE:	CVE-2014-1989
Remote:	Yes
Local:	No
Published:	Apr 30 2014 12:00AM
Updated:	Apr 30 2014 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Cybozu Garoon 3.0 Cybozu Garoon 3.7 Service Pack 3 Cybozu Garoon 3.7 service pack 2 Cybozu Garoon 3.7 Service Pack 1 Cybozu Garoon 3.7 Cybozu Garoon 3.5.5 Cybozu Garoon 3.5.4 Cybozu Garoon 3.5.3 Cybozu Garoon 3.5.2 Cybozu Garoon 3.5.1 Cybozu Garoon 3.5.0 Cybozu Garoon 3.5 Service Pack 5 Cybozu Garoon 3.5 Cybozu Garoon 3.1.3 Cybozu Garoon 3.1.2 Cybozu Garoon 3.1.1 Cybozu Garoon 3.1.0 Cybozu Garoon 3.1 Cybozu Garoon 3.0.3 Cybozu Garoon 3.0.2 Cybozu Garoon 3.0.1
Not Vulnerable:

Cybozu Garoon API Appointment Security Bypass Vulnerability

Attackers can exploit this issue through a browser.

Cybozu Garoon API Appointment Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cybozu Garoon API Appointment Security Bypass Vulnerability

References:

• Cybozu Homepage (Cybozu)
  
• JVNDB-2014-000043 Cybozu Garoon API access restriction bypass vulnerability (JPCERT)
  
• Cybozu Garoon API access restriction bypass vulnerability (JPCERT)
  
• Cybozu Garoon API Appointment Security Bypass Vulnerability (Cybozu)