Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
jvnJapan Vulnerability NotesJVN:54794245
HistoryAug 02, 2021 - 12:00 a.m.

JVN#54794245: Multiple vulnerabilities in Cybozu Garoon

2021-08-0200:00:00
Japan Vulnerability Notes
jvn.jp
43
cybozu garoon
multiple vulnerabilities
cross-site scripting
input validation
operational restrictions bypass
cve-2021-20753
cve-2021-20754
cve-2021-20755
cve-2021-20756
cve-2021-20757
cve-2021-20758
cve-2021-20759
cve-2021-20760
cve-2021-20761
cve-2021-20762
cve-2021-20763
cve-2021-20764

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.9%

JSON

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below.

[CyVDB-1782] Cross-site scripting vulnerability in Scheduler (CWE-79) - CVE-2021-20753

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

[CyVDB-2029] Improper input validation vulnerability in Workflow (CWE-20) - CVE-2021-20754

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2071] Viewing restrictions bypass vulnerability in Portal (CWE-264) - CVE-2021-20755

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

[CyVDB-2085] Viewing restrictions bypass vulnerability in Address (CWE-264) - CVE-2021-20756

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

[CyVDB-2092] Operational restrictions bypass vulnerability in E-mail (CWE-264) - CVE-2021-20757

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2099] Cross-site request forgery vulnerability in Message (CWE-352) - CVE-2021-20758

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

[CyVDB-2103] Operational restrictions bypass vulnerability in Bulletin (CWE-264) - CVE-2021-20759

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2234] Improper input validation vulnerability in User Profile (CWE-20) - CVE-2021-20760

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2245][CyVDB-2374] Improper input validation vulnerability in E-mail (CWE-20) - CVE-2021-20761

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N Base Score: 4.1
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2283] Improper input validation vulnerability in E-mail (CWE-20) - CVE-2021-20762

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Base Score: 5.0
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2368] Operational restrictions bypass vulnerability in Portal (CWE-264) - CVE-2021-20763

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2388] Improper input validation vulnerability in Attaching Files (CWE-20) - CVE-2021-20764

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:H/Au:N/C:P/I:N/A:N Base Score: 2.6

[CyVDB-2406] Cross-site scripting vulnerability in Bulletin (CWE-79) - CVE-2021-20765

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

[CyVDB-2407] Cross-site scripting vulnerability in Message (CWE-79) - CVE-2021-20766

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

[CyVDB-2446] Cross-site scripting vulnerability in Full Text Search (CWE-79) - CVE-2021-20767

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

[CyVDB-2448] Operational restrictions bypass vulnerability in Scheduler and MultiReport (CWE-264) - CVE-2021-20768

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:N Base Score: 4.0

[CyVDB-2568] Cross-site scripting vulnerability in Bulletin (CWE-79) - CVE-2021-20769

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

[CyVDB-2659] Cross-site scripting vulnerability in Message (CWE-79) - CVE-2021-20770

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

[CyVDB-2193] Cross-site scripting vulnerability in some functions of E-mail (CWE-79) - CVE-2021-20771

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Base Score: 6.1
CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N Base Score: 2.6

[CyVDB-2479] Title information disclosure vulnerability in Bulletin (CWE-264) - CVE-2021-20772

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

[CyVDB-2755] Vulnerability where route information of Workflow is deleted unintentionally - CVE-2021-20773

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Base Score: 5.4
CVSS v2 AV:N/AC:L/Au:S/C:N/I:P/A:P Base Score: 5.5

[CyVDB-2766] Cross-site scripting vulnerability in some functions of E-mail (CWE-79) - CVE-2021-20774

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Base Score: 5.4
CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N Base Score: 3.5

[CyVDB-2903] Comment destination information disclosure vulnerability (CWE-20) - CVE-2021-20775

Version Vector Score
CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Base Score: 4.3
CVSS v2 AV:N/AC:L/Au:S/C:P/I:N/A:N Base Score: 4.0

Impact

  • [CyVDB-1782], [CyVDB-2193], [CyVDB-2406], [CyVDB-2407], [CyVDB-2446], [CyVDB-2568], [CyVDB-2659], [CyVDB-2766]:
    An arbitrary script may be executed on a logged-in user’s web browser.
  • [CyVDB-2029]:
    A user who can log in to the product may alter the data of Workflow without the appropriate privilege.
  • [CyVDB-2071]:
    A user who can log in to the product may obtain the data of Portal without the viewing privilege.
  • [CyVDB-2085]:
    A user who can log in to the product may obtain the data of Address without the viewing privilege.
  • [CyVDB-2092], [CyVDB-2283]:
    A user who can log in to the product may alter the data of E-mail without the appropriate privilege.
  • [CyVDB-2099]:
    If a user views a malicious page while logged in, unintended operations may be performed.
  • [CyVDB-2103]:
    A user who can log in to the product may alter the data of Bulletin without the appropriate privilege.
  • [CyVDB-2234]:
    A user who can log in to the product may alter the data of User Profile without the appropriate privilege.
  • [CyVDB-2245]、[CyVDB-2374]:
    A user who can log in to the product with administrative privilege may alter the data of E-mail without the appropriate privilege.
  • [CyVDB-2368]:
    A user who can log in to the product may alter the data of Portal without the appropriate privilege.
  • [CyVDB-2388]:
    A remote attacker may obtain the data of Attaching Files.
  • [CyVDB-2448]:
    A user who can log in to the product may delete the data of Scheduler and MultiReport without the appropriate privilege.
  • [CyVDB-2479]:
    A user who can log in to the product may obtain the title of Bulletin without the viewing privilege.
  • [CyVDB-2755]:
    A user who can log in to the product may delete the route information of Workflow without the appropriate privilege.
  • [CyVDB-2903]:
    A user who can log in to the product may obtain the data of Comment and Space without the viewing privilege.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

[CyVDB-1782], [CyVDB-2029], [CyVDB-2071], [CyVDB-2085], [CyVDB-2092], [CyVDB-2099], [CyVDB-2234], [CyVDB-2245], [CyVDB-2283], [CyVDB-2368], [CyVDB-2374], [CyVDB-2388], [CyVDB-2406], [CyVDB-2407], [CyVDB-2446], [CyVDB-2448]

  • Cybozu Garoon 4.0.0 to 5.0.2
    [CyVDB-2103], [CyVDB-2568], [CyVDB-2659]

  • Cybozu Garoon 4.6.0 to 5.0.2
    [CyVDB-2193], [CyVDB-2755], [CyVDB-2766]

  • Cybozu Garoon 4.0.0 to 5.5.0
    [CyVDB-2479], [CyVDB-2903]

  • Cybozu Garoon 4.10.0 to 5.5.0

Related

nvd 23
cnvd 23
cvelist 23
prion 23
cve 23
nvd
nvd
CVE-2021-20758
2021-08-18 06:15:06
CVE-2021-20759
2021-08-18 06:15:06
CVE-2021-20754
2021-08-18 06:15:06
cnvd
cnvd
Cybozu Garoon Attaching Files Incorrectly Entered Validation Vulnerability
2021-08-03 00:00:00
Cybozu Garoon message deletion vulnerability
2021-08-03 00:00:00
Cybozu Garoon Bulletin Cross-Site Scripting Vulnerability (CNVD-2021-59724)
2021-08-03 00:00:00
cvelist
cvelist
CVE-2021-20764
2021-08-18 05:36:07
CVE-2021-20769
2021-08-18 05:36:15
CVE-2021-20768
2021-08-18 05:36:13
prion
prion
Input validation
2021-08-18 06:15:00
Input validation
2021-08-18 06:15:00
Design/Logic Flaw
2021-08-18 06:15:00
cve
cve
CVE-2021-20768
2021-08-18 06:15:07
CVE-2021-20754
2021-08-18 06:15:06
CVE-2021-20756
2021-08-18 06:15:06

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.9%

JSON
Related for JVN:54794245
nvd23cnvd23cvelist23prion23cve23