Published:2017/02/20  Last Updated:2017/02/20

JVN#73182875
Multiple vulnerabilities in Cybozu Garoon

Overview

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities.

Products Affected

  • Cybozu Garoon 3.0.0 to 4.2.3

Description

Cybozu Garoon provided by Cybozu,Inc. is a groupware. Cybozu Garoon contains multiple vulnerabilities listed below.

  • SQL injection (CWE-89) - CVE-2017-2090
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Base Score: 6.3
    CVSS v2 AV:N/AC:L/Au:S/C:P/I:P/A:P Base Score: 6.5
  • Access restriction flaw in the Phone Messages function (CWE-284) - CVE-2017-2091
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Cross-site scripting (CWE-79) - CVE-2017-2092
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Base Score: 5.4
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Information disclosure (CWE-200) - CVE-2017-2093
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:M/Au:N/C:P/I:N/A:N Base Score: 4.3
  • Access restriction flaw in Workflow and the function "MultiReport" (CWE-284) - CVE-2017-2094
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:M/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0
  • Access restriction flaw in the mail function (CWE-284) - CVE-2017-2095
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:M/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

Impact

  • A user may execute arbitrary SQL commands - CVE-2017-2090
  • A user may set uncofirmed phone messages to be displayed as if they have already been confirmed - CVE-2017-2091
  • Arbitrary scripts may be executed on the logged-in user's web browser - CVE-2017-2092
  • Token used for cross-site request forgery (CSRF) protection may be disclosed - CVE-2017-2093
  • A user may alter or delete information of Workflow and the multi report function, which the user does not have permission to access - CVE-2017-2094
  • A user may alter the order of the mail folders - CVE-2017-2095

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
Cybozu, Inc. Vulnerable 2017/02/20 Cybozu, Inc. website

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Cybozu, Inc. reported CVE-2017-2090, CVE-2017-2092, CVE-2017-2093, CVE-2017-2094 and CVE-2017-2095 vulnerabilities to JPCERT/CC to notify users of its solution through JVN.
Yuji Tounai reported CVE-2017-2091 vulnerability to Cybozu, Inc., and Cybozu, Inc. reported it to JPCERT/CC to notify users of its solution through JVN.
JPCERT/CC and Cybozu, Inc. coordinated under the Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2017-2090
CVE-2017-2091
CVE-2017-2092
CVE-2017-2093
CVE-2017-2094
CVE-2017-2095
JVN iPedia JVNDB-2017-000027
JVNDB-2017-000028
JVNDB-2017-000029
JVNDB-2017-000030
JVNDB-2017-000031
JVNDB-2017-000032