JVN#55497111
Multiple vulnerabilities in Cybozu Garoon

Overview

Cybozu, Inc. has released security updates for Cybozu Garoon.

Products Affected

[CyVDB-2083], [CyVDB-2451], [CyVDB-2097], [CyVDB-2289], [CyVDB-2305], [CyVDB-2361]

• Cybozu Garoon 4.0.0 to 5.0.1

• Cybozu Garoon 5.0.0 to 5.0.1

• Cybozu Garoon 4.10.3 to 5.0.1

Description

Cybozu, Inc. has released security updates for Cybozu Garoon.

• [CyVDB-2083] Vulnerability in Single sign-on settings to avoid viewing and operation privileges - CVE-2020-5580

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	Base Score: 8.5
  CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:N	Base Score: 5.5

• [CyVDB-2451] Path traversal vulnerability on the portal - CVE-2020-5581

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	Base Score: 7.7
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

• [CyVDB-2097] Vulnerability to bypass operation privileges on attachments - CVE-2020-5582

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:L/Au:S/C:N/I:P/A:N	Base Score: 4.0

• [CyVDB-2289] Vulnerability in the Multi-Report to bypass view privileges - CVE-2020-5583

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:L/Au:S/C:P/I:N/A:N	Base Score: 4.0

• [CyVDB-2305] Vulnerability to token-related information leakage - CVE-2020-5584

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	Base Score: 6.5
  CVSS v2	AV:N/AC:L/Au:N/C:P/I:N/A:N	Base Score: 5.0

• [CyVDB-2308] Cross-site scripting vulnerability related to image asset functionality - CVE-2020-5585

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:L/Au:S/C:P/I:P/A:N	Base Score: 5.5

• [CyVDB-2309] Cross-site scripting vulnerability in system configuration - CVE-2020-5586

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Base Score: 4.8
  CVSS v2	AV:N/AC:L/Au:S/C:N/I:P/A:N	Base Score: 4.0

• [CyVDB-2361] Vulnerability to token-related information leakage - CVE-2020-5587

  CVSS v3	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N	Base Score: 5.3
  CVSS v2	AV:N/AC:H/Au:N/C:P/I:N/A:N	Base Score: 2.6

• [CyVDB-2450] Path traversal vulnerability on the portal - CVE-2020-5588

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N	Base Score: 6.8
  CVSS v2	AV:N/AC:L/Au:S/C:P/I:N/A:N	Base Score: 4.0

Impact

• [CyVDB-2083]:
  A user may view and/or alter Single sign-on settings.
• [CyVDB-2451]:
  A user may obtain unintended information.
• [CyVDB-2097]:
  A user may alter the data for the file attached to Report.
• [CyVDB-2289]:
  A user may obtain Multi-Report's data which the user has no viewing privileges of.
• [CyVDB-2305] and [CyVDB-2361]:
  A remote attacker may obtain unintended information.
• [CyVDB-2308] and [CyVDB-2309]:
  An arbitrary script may be executed on the web browser of the user who logged in to the product with the administrative privilege.
• [CyVDB-2450]:
  A user with administrative privilege may obtain unintended information.

Solution

Update the Software
Update the affected software to the appropriate latest version according to the information provided by the developer.