JVN#23568423: Cybozu KUNAI for Android vulnerable to arbitrary Java method execution

Cybozu KUNAI is a mobile client software for using Cybozu. Cybozu KUNAI for Android contains an arbitrary Java method execution vulnerability.

Impact

When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android devices may be obtained and arbitrary OS commands may be executed.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Products Affected

• Cybozu KUNAI for Android version 2.0.5 and earlier