jvndb - jvndb-2016-000224

jvndb-2016-000224

Vulnerability from jvndb

Published

2016-12-19 14:29

Modified

2017-11-27 16:58

Severity

6.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Summary

Cybozu Garoon fails to restrict access permission in the RSS settings

Details

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the RSS settings. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning Partnership.

References

Type	URL
JVN	http://jvn.jp/en/jp/JVN14631222/index.html
CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2016-4908
NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-4908
Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor	Product
Cybozu, Inc.	Cybozu Garoon

Show details on JVN DB website

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000224.html",
  "dc:date": "2017-11-27T16:58+09:00",
  "dcterms:issued": "2016-12-19T14:29+09:00",
  "dcterms:modified": "2017-11-27T16:58+09:00",
  "description": "Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains an access restriction flaw in the RSS settings.\r\n\r\nCybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000224.html",
  "sec:cpe": {
    "#text": "cpe:/a:cybozu:garoon",
    "@product": "Cybozu Garoon",
    "@vendor": "Cybozu, Inc.",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.0",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2016-000224",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN14631222/index.html",
      "@id": "JVN#14631222",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2016-4908",
      "@id": "CVE-2016-4908",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2016-4908",
      "@id": "CVE-2016-4908",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    }
  ],
  "title": "Cybozu Garoon fails to restrict access permission in the RSS settings"
}

cve-2016-4908

Vulnerability from cvelistv5

Published

2017-06-09 16:00

Modified

2024-08-06 00:46

Severity

Summary

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.

References

URL	Tags
https://jvn.jp/en/jp/JVN14631222/index.html	third-party-advisory, x_refsource_JVN
http://www.securityfocus.com/bid/97912	vdb-entry, x_refsource_BID
http://www.securityfocus.com/bid/94966	vdb-entry, x_refsource_BID
https://support.cybozu.com/ja-jp/article/9399	x_refsource_CONFIRM

Impacted products

Vendor	Product
Cybozu, Inc.	Cybozu Garoon

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:46:39.909Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "JVN#14631222",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN14631222/index.html"
          },
          {
            "name": "97912",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97912"
          },
          {
            "name": "94966",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/94966"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.cybozu.com/ja-jp/article/9399"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cybozu Garoon",
          "vendor": "Cybozu, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0 to 4.2.2"
            }
          ]
        }
      ],
      "datePublic": "2016-12-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user\u0027s private RSS settings via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Fails to restrict access",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-06-12T09:57:01",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "name": "JVN#14631222",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "https://jvn.jp/en/jp/JVN14631222/index.html"
        },
        {
          "name": "97912",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97912"
        },
        {
          "name": "94966",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/94966"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.cybozu.com/ja-jp/article/9399"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2016-4908",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cybozu Garoon",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.0.0 to 4.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cybozu, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user\u0027s private RSS settings via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Fails to restrict access"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "JVN#14631222",
              "refsource": "JVN",
              "url": "https://jvn.jp/en/jp/JVN14631222/index.html"
            },
            {
              "name": "97912",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97912"
            },
            {
              "name": "94966",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/94966"
            },
            {
              "name": "https://support.cybozu.com/ja-jp/article/9399",
              "refsource": "CONFIRM",
              "url": "https://support.cybozu.com/ja-jp/article/9399"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2016-4908",
    "datePublished": "2017-06-09T16:00:00",
    "dateReserved": "2016-05-17T00:00:00",
    "dateUpdated": "2024-08-06T00:46:39.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.