jvndb-2021-000022
Vulnerability from jvndb
Published
2021-03-15 15:56
Modified
2021-12-17 17:51
Severity ?
Summary
Multiple vulnerabilities in Cybozu Office
Details
Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below.
*[CyVDB-1657] Operational restrictions bypass vulnerability in Scheduler (CWE-264) - CVE-2021-20624
*[CyVDB-1727] Operational restrictions bypass vulnerability in Bulletin Board (CWE-264) - CVE-2021-20625
*[CyVDB-1895][CyVDB-2658] Operational restrictions bypass vulnerability in Workflow (CWE-264) - CVE-2021-20626
*[CyVDB-1899] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20627
*[CyVDB-1924] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20628
*[CyVDB-2014] Cross-site scripting vulnerability in E-mail (CWE-79) - CVE-2021-20629
*[CyVDB-2018] Viewing restrictions bypass vulnerability in Phone Messages (CWE-264) - CVE-2021-20630
*[CyVDB-2063] Improper input validation vulnerability in Custom App (CWE-20) - CVE-2021-20631
*[CyVDB-2263] Viewing restrictions bypass vulnerability in Bulletin Board (CWE-264) - CVE-2021-20632
*[CyVDB-2310] Viewing restrictions bypass vulnerability in Cabinet (CWE-264) - CVE-2021-20633
*[CyVDB-2764] Viewing restrictions bypass vulnerability in Custom App (CWE-264) - CVE-2021-20634
*[CyVDB-1900] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20849
CVE-2021-20624, CVE-2021-20625 and CVE-2021-20629
Yuji Tounai reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.
CVE-2021-20627, CVE-2021-20628 and CVE-2021-20849
Kanta Nishitani of Ierae Security Inc. reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.
CVE-2021-20630 and CVE-2021-20631
Shuichi Uruma reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.
CVE-2021-20626, CVE-2021-20632, CVE-2021-20633 and CVE-2021-20634
Cybozu, Inc. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cybozu, Inc. | Cybozu Office |
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000022.html", "dc:date": "2021-12-17T17:51+09:00", "dcterms:issued": "2021-03-15T15:56+09:00", "dcterms:modified": "2021-12-17T17:51+09:00", "description": "Cybozu Office provided by Cybozu, Inc. contains multiple vulnerabilities listed below.\r\n\r\n*[CyVDB-1657] Operational restrictions bypass vulnerability in Scheduler (CWE-264) - CVE-2021-20624\r\n*[CyVDB-1727] Operational restrictions bypass vulnerability in Bulletin Board (CWE-264) - CVE-2021-20625\r\n*[CyVDB-1895][CyVDB-2658] Operational restrictions bypass vulnerability in Workflow (CWE-264) - CVE-2021-20626\r\n*[CyVDB-1899] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20627\r\n*[CyVDB-1924] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20628\r\n*[CyVDB-2014] Cross-site scripting vulnerability in E-mail (CWE-79) - CVE-2021-20629\r\n*[CyVDB-2018] Viewing restrictions bypass vulnerability in Phone Messages (CWE-264) - CVE-2021-20630\r\n*[CyVDB-2063] Improper input validation vulnerability in Custom App (CWE-20) - CVE-2021-20631\r\n*[CyVDB-2263] Viewing restrictions bypass vulnerability in Bulletin Board (CWE-264) - CVE-2021-20632\r\n*[CyVDB-2310] Viewing restrictions bypass vulnerability in Cabinet (CWE-264) - CVE-2021-20633\r\n*[CyVDB-2764] Viewing restrictions bypass vulnerability in Custom App (CWE-264) - CVE-2021-20634\r\n*[CyVDB-1900] Cross-site scripting vulnerability in Address Book (CWE-79) - CVE-2021-20849\r\n\r\nCVE-2021-20624, CVE-2021-20625 and CVE-2021-20629\r\nYuji Tounai reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.\r\n\r\nCVE-2021-20627, CVE-2021-20628 and CVE-2021-20849\r\nKanta Nishitani of Ierae Security Inc. reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.\r\n\r\nCVE-2021-20630 and CVE-2021-20631\r\nShuichi Uruma reported these vulnerabilities to Cybozu, Inc. and Cybozu, Inc. reported them to JPCERT/CC to notify users of the solutions through JVN.\r\n\r\nCVE-2021-20626, CVE-2021-20632, CVE-2021-20633 and CVE-2021-20634\r\nCybozu, Inc. reported these vulnerabilities to JPCERT/CC to notify users of the solution through JVN.", "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000022.html", "sec:cpe": { "#text": "cpe:/a:cybozu:office", "@product": "Cybozu Office", "@vendor": "Cybozu, Inc.", "@version": "2.2" }, "sec:cvss": [ { "@score": "4.0", "@severity": "Medium", "@type": "Base", "@vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "@version": "2.0" }, { "@score": "4.3", "@severity": "Medium", "@type": "Base", "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "@version": "3.0" } ], "sec:identifier": "JVNDB-2021-000022", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN45797538/index.html", "@id": "JVN#45797538", "@source": "JVN" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20624", "@id": "CVE-2021-20624", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20625", "@id": "CVE-2021-20625", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20626", "@id": "CVE-2021-20626", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20627", "@id": "CVE-2021-20627", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20628", "@id": "CVE-2021-20628", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20629", "@id": "CVE-2021-20629", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20630", "@id": "CVE-2021-20630", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20631", "@id": "CVE-2021-20631", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20632", "@id": "CVE-2021-20632", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20633", "@id": "CVE-2021-20633", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20634", "@id": "CVE-2021-20634", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20849", "@id": "CVE-2021-20849", "@source": "CVE" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20624", "@id": "CVE-2021-20624", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20625", "@id": "CVE-2021-20625", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20626", "@id": "CVE-2021-20626", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20627", "@id": "CVE-2021-20627", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20628", "@id": "CVE-2021-20628", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20629", "@id": "CVE-2021-20629", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20630", "@id": "CVE-2021-20630", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20631", "@id": "CVE-2021-20631", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20632", "@id": "CVE-2021-20632", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20633", "@id": "CVE-2021-20633", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20634", "@id": "CVE-2021-20634", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20849", "@id": "CVE-2021-20849", "@source": "NVD" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-20", "@title": "Improper Input Validation(CWE-20)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-264", "@title": "Permissions(CWE-264)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)" } ], "title": "Multiple vulnerabilities in Cybozu Office" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.