Published:2019/04/25  Last Updated:2020/04/27

JVN#58849431
Multiple vulnerabilities in Cybozu Garoon

Overview

Cybozu Garoon contains multiple vulnerabilities.

Products Affected

CVE-2019-5928 to CVE-2019-5931

  • Cybozu Garoon 4.0.0 to 4.6.3
CVE-2019-5932 and CVE-2020-5562
  • Cybozu Garoon 4.6.0 to 4.6.3
CVE-2019-5933 and CVE-2019-5934
  • Cybozu Garoon 4.0.0 to 4.10.0
CVE-2019-5935 to CVE-2019-5944
  • Cybozu Garoon 4.0.0 to 4.10.1
CVE-2019-5945 and CVE-2019-5946
  • Cybozu Garoon 4.2.4 to 4.10.1
CVE-2019-5947
  • Cybozu Garoon 4.6.0 to 4.10.1

Description

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below.

  • Cross-site scripting in the additional processing of Customize Item function (CWE-79) - CVE-2019-5928
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6
  • Cross-site scripting in the application "Memo" (CWE-79) - CVE-2019-5929
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:L/Au:N/C:N/I:P/A:N Base Score: 5.0
  • Browse restriction bypass in the application "Management of Basic System" (CWE-264) - CVE-2019-5930
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0
  • Improper verification of file path in installer (CWE-20) - CVE-2019-5931
    CVSS v3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H Base Score: 6.0
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:P Base Score: 4.9
  • Stored cross-site scripting in the application "Portal" (CWE-79) - CVE-2019-5932
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Base Score: 4.8
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5
  • Browse restriction bypass in the application "Bulletin" (CWE-284) - CVE-2019-5933
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:M/Au:S/C:P/I:N/A:N Base Score: 3.5
  • SQL injection in the Log Search function of application "logging" (CWE-89) - CVE-2019-5934
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L Base Score: 6.0
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:P Base Score: 6.5
  • Operation restriction bypass in the Item function of User Information (CWE-264) - CVE-2019-5935
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Directory traversal in the application "Work Flow" (CWE-22) - CVE-2019-5936
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:N Base Score: 5.5
  • Cross-site scripting in the user information (CWE-79) - CVE-2019-5937
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5
  • Stored cross-site scripting in the application "Mail" (CWE-79) - CVE-2019-5938
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3
  • Cross-site scripting in the application "Portal" (CWE-79) - CVE-2019-5939
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6
  • Cross-site scripting in the application "Scheduler" (CWE-79) - CVE-2019-5940
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
    CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6
  • Operation restriction bypass in the application "Multi Report" (CWE-264) - CVE-2019-5941
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Browse restriction bypass in the Multiple Files Download function of application "Cabinet" (CWE-284) - CVE-2019-5942
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0
  • Browse restriction bypass in the application "Bulletin" and the application "Cabinet" (CWE-284) - CVE-2019-5943
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0
  • Operation restriction bypass in the application "Address" (CWE-264) - CVE-2019-5944
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Information disclosure in the authentication of Cybozu Garoon (CWE-287) - CVE-2019-5945
    CVSS v3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Base Score: 5.3
    CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N Base Score: 4.3
  • Open redirect in the Login Screen (CWE-601) - CVE-2019-5946
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N Base Score: 7.4
    CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N Base Score: 4.3
  • Cross-site scripting in the application "Cabinet" (CWE-79) - CVE-2019-5947
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Server-side request forgery in the V-CUBE Meeting function (CWE-918) - CVE-2020-5562
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N Base Score: 6.8
    CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

Impact

  • An arbitrary script may be executed on a user's web browser. - CVE-2019-5929
  • An arbitrary script may be executed on a logged in user's web browser. - CVE-2019-5928, CVE-2019-5932, CVE-2019-5937, CVE-2019-5938, CVE-2019-5939, CVE-2019-5940, CVE-2019-5947
  • A user, who can login to the product, may view the information without view privileges. - CVE-2019-5930, CVE-2019-5943
  • Information may be altered with the privilege of the user invoking the installer. - CVE-2019-5931
  • A user, who can login to the product, may view the Bulletin Board without view privileges. - CVE-2019-5933
  • A user, who can access to the product with administrative privileges, may execute an arbitrary SQL commands. - CVE-2019-5934
  • A remote attacker may change user information without access privileges. - CVE-2019-5935
  • A user, who can login to the product, may obtain file without access privileges. - CVE-2019-5936, CVE-2019-5942
  • A user, who can login to the product, may alter the Report without access privileges. - CVE-2019-5941
  • A user, who can login to the product, may alter the contents of application "Address" without modify privileges. - CVE-2019-5944
  • Users' credential information may be disclosed. - CVE-2019-5945
  • When accessing a specially crafted URL, a user may be redirected to an arbitrary website. - CVE-2019-5946
  • A user who can login to the product with an administrative privilege may issue arbitrary HTTP requests to other web servers from the product - CVE-2020-5562

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
Cybozu, Inc. Vulnerable 2020/04/27 Cybozu, Inc. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Cybozu, Inc. reported the following vulnerabilities to JPCERT/CC to notify users of the solution through JVN.

* CVE-2019-5928, CVE-2019-5930, CVE-2019-5931, CVE-2019-5932, CVE-2019-5935, CVE-2019-5936, CVE-2019-5942 and CVE-2019-5947 by Cybozu, Inc.
* CVE-2019-5929, CVE-2019-5937, CVE-2019-5938, CVE-2019-5939 and CVE-2019-5940 by Masato Kinugawa
* CVE-2019-5933, CVE-2019-5941 and CVE-2019-5946 by Yuji Tounai
* CVE-2019-5934 and CVE-2019-5945 by Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc.
* CVE-2019-5943 by ixama
* CVE-2019-5944 by Tanghaifeng
* CVE-2020-5562 by Kanta Nishitani

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2019-5928
CVE-2019-5929
CVE-2019-5930
CVE-2019-5931
CVE-2019-5932
CVE-2019-5933
CVE-2019-5934
CVE-2019-5935
CVE-2019-5936
CVE-2019-5937
CVE-2019-5938
CVE-2019-5939
CVE-2019-5940
CVE-2019-5941
CVE-2019-5942
CVE-2019-5943
CVE-2019-5944
CVE-2019-5945
CVE-2019-5946
CVE-2019-5947
CVE-2020-5562
JVN iPedia JVNDB-2019-000023

Update History

2020/04/27
Cybozu, Inc. update status
2020/04/27
Information under the section [Products Affected], [Description], [Impact] and [Credit] were updated, CVE-2020-5562 was added to [Other Information]