CVE-2021-20628
Vulnerability from cvelistv5
Published
2021-03-18 00:55
Modified
2024-08-03 17:45
Severity
Summary
Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.
References
Source | URL | Tags |
---|---|---|
vultures@jpcert.or.jp | https://jvn.jp/en/jp/JVN45797538/index.html | Third Party Advisory |
vultures@jpcert.or.jp | https://kb.cybozu.support/article/36868/ | Vendor Advisory |
Impacted products
Vendor | Product |
---|---|
Cybozu, Inc. | Cybozu Office |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T17:45:45.027Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://jvn.jp/en/jp/JVN45797538/index.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://kb.cybozu.support/article/36868/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cybozu Office", "vendor": "Cybozu, Inc.", "versions": [ { "status": "affected", "version": "10.0.0 to 10.8.4" } ] } ], "descriptions": [ { "lang": "en", "value": "Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox." } ], "problemTypes": [ { "descriptions": [ { "description": "Cross-site scripting", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-03-18T00:55:59", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://jvn.jp/en/jp/JVN45797538/index.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://kb.cybozu.support/article/36868/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2021-20628", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Cybozu Office", "version": { "version_data": [ { "version_value": "10.0.0 to 10.8.4" } ] } } ] }, "vendor_name": "Cybozu, Inc." } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Cross-site scripting" } ] } ] }, "references": { "reference_data": [ { "name": "https://jvn.jp/en/jp/JVN45797538/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN45797538/index.html" }, { "name": "https://kb.cybozu.support/article/36868/", "refsource": "MISC", "url": "https://kb.cybozu.support/article/36868/" } ] } } } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2021-20628", "datePublished": "2021-03-18T00:55:59", "dateReserved": "2020-12-17T00:00:00", "dateUpdated": "2024-08-03T17:45:45.027Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2021-20628\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2021-03-18T01:15:11.797\",\"lastModified\":\"2021-03-23T14:28:37.430\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de Cross-site scripting en Address Book de Cybozu Office versiones 10.0.0 hasta 10.8.4, permite a atacantes remotos inyectar un script arbitrario por medio de vectores no especificados.\u0026#xa0;Tome en cuenta que esta vulnerabilidad se produce solo cuando se usa Mozilla Firefox\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97D4FFCF-5309-43B6-9FD5-680C6D535A7F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cybozu:office:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.8.4\",\"matchCriteriaId\":\"A468F5BE-4EB2-464F-AE29-D0C98163C410\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN45797538/index.html\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://kb.cybozu.support/article/36868/\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading...