JVN#25385698: Cybozu Garoon access restriction bypass vulnerability

Single sign-on function of Cybozu Garoon provided by Cybozu, Inc. contains a restriction bypass vulnerability (CWE-284).

Impact

An attacker who can access the product may bypass authentication of Single sign-on function and view the information which is available only for sign-on users.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.

[Updated on 2019 April 22] Update the Software
Update to the latest version according to the information provided by the developer.
According to developer, this vulnerability was addressed in Cybozu Garoon 4.10.1.

Products Affected

• Cybozu Garoon 3.0.0 to 4.10.0