Published:2017/04/11  Last Updated:2017/04/11

JVN#17535578
Multiple vulnerabilities in Cybozu Office

Overview

Cybozu Office contains multiple vulnerabilities.

Products Affected

  • Cybozu Office 10.0.0 to 10.5.0

Description

Cybozu Office contains multiple vulnerabilities listed below.

  • Cross-site scripting in the design setting screen (CWE-79) - CVE-2017-2114
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Access restriction flaw in the file export function in "customapp" (CWE-284) - CVE-2017-2115
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0
  • Access restriction flaw in the templates delete function in "customapp" (CWE-284) - CVE-2017-2116
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base Score: 5.4
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:P Base Score: 5.5
  • Denial-of-service (DoS) in the API (CWE-20) - CVE-2016-4449
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Base Score: 7.5
    CVSS v2 AV:N/AC:L/Au:N/C:N/I:N/A:C Base Score: 7.8

Impact

  • Arbitrary scripts may be executed on the logged-in user's web browser - CVE-2017-2114
  • Information of "customapp" may be obtained by the other logged-in user - CVE-2017-2115
  • "customapp" templates may be deleted by the other logged-in user - CVE-2017-2116
  • A denial-of-service (DoS) attack may cause a web server to crash - CVE-2016-4449

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
Cybozu, Inc. Vulnerable 2017/04/11 Cybozu, Inc. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Cybozu, Inc. reported CVE-2017-2115, CVE-2017-2116 and CVE-2016-4449 vulnerabilities to JPCERT/CC to notify users of its solution through JVN.
Kazuto Sagamihara reported 2017-2114 vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN.
JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2017-2114
CVE-2017-2115
CVE-2017-2116
CVE-2016-4449
JVN iPedia JVNDB-2017-000063
JVNDB-2017-000064
JVNDB-2017-000065
JVNDB-2017-000066

Update History

2017/04/11
Information under the section "Impact" was modified.