Published:2008/06/27  Last Updated:2008/07/07

Cybozu Garoon session fixation vulnerability


Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability.

Products Affected

  • Cybozu Garoon version 2.0.0 - 2.1.3


Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the attacker.


A remote attacker impersonating a logged in user may execute arbitrary code with the privilege of the user. As a result, disclosure or alteration of information may occur.


Update the Software
Apply the latest update provided by the vendor.

Vendor Status

Vendor Status Last Update Vendor Notes
Cybozu, Inc. Vulnerable 2008/06/27


JPCERT/CC Addendum

The vendor has published information on this problem on April 14 2008.

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.06.27

Measures Conditions Severity
Access Required Routed - can be attacked over the Internet using packets
  • High
Authentication None - anonymous or no authentication (IP addresses do not count)
  • High
User Interaction Required Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file
  • Medium
Exploit Complexity Low - little to no expertise and/or luck required to exploit (cross-site scripting)
  • High

Description of each analysis measures


Yoshihiro Ishikawa of LAC (Little eArth Corporation) reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Reports
CERT Advisory
CPNI Advisory
CVE CVE-2008-6569
JVN iPedia JVNDB-2008-000034

Update History