Lucene search

JpcertCVE-2015-8489

HistoryFeb 17, 2016 - 2:59 a.m.

CVE-2015-8489

2016-02-1702:59:09

CWE-20

jpcert

web.nvd.nist.gov

cve-2015-8489

cybozu office

denial of service

csv file

remote authenticated users

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.1

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.

Affected configurations

Nvd

Node

cybozuofficeMatch9.9.0

cybozuofficeMatch10.0.0

cybozuofficeMatch10.0.1

cybozuofficeMatch10.0.2

cybozuofficeMatch10.1.0

cybozuofficeMatch10.1.2

cybozuofficeMatch10.2.0

cybozuofficeMatch10.3.0

VendorProductVersionCPE
cybozuoffice9.9.0cpe:2.3:a:cybozu:office:9.9.0:*:*:*:*:*:*:*
cybozuoffice10.0.0cpe:2.3:a:cybozu:office:10.0.0:*:*:*:*:*:*:*
cybozuoffice10.0.1cpe:2.3:a:cybozu:office:10.0.1:*:*:*:*:*:*:*
cybozuoffice10.0.2cpe:2.3:a:cybozu:office:10.0.2:*:*:*:*:*:*:*
cybozuoffice10.1.0cpe:2.3:a:cybozu:office:10.1.0:*:*:*:*:*:*:*
cybozuoffice10.1.2cpe:2.3:a:cybozu:office:10.1.2:*:*:*:*:*:*:*
cybozuoffice10.2.0cpe:2.3:a:cybozu:office:10.2.0:*:*:*:*:*:*:*
cybozuoffice10.3.0cpe:2.3:a:cybozu:office:10.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cybozu	office	9.9.0	cpe:2.3:a:cybozu:office:9.9.0:::::::*
cybozu	office	10.0.0	cpe:2.3:a:cybozu:office:10.0.0:::::::*
cybozu	office	10.0.1	cpe:2.3:a:cybozu:office:10.0.1:::::::*
cybozu	office	10.0.2	cpe:2.3:a:cybozu:office:10.0.2:::::::*
cybozu	office	10.1.0	cpe:2.3:a:cybozu:office:10.1.0:::::::*
cybozu	office	10.1.2	cpe:2.3:a:cybozu:office:10.1.2:::::::*
cybozu	office	10.2.0	cpe:2.3:a:cybozu:office:10.2.0:::::::*
cybozu	office	10.3.0	cpe:2.3:a:cybozu:office:10.3.0:::::::*

References

jvn.jp/en/jp/JVN20246313/index.html

jvndb.jvn.jp/jvndb/JVNDB-2016-000020

cs.cybozu.co.jp/2015/006073.html

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.1

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Related for CVE-2015-8489