Vulnerability CVE-2016-1193


Published: 2016-06-25   Modified: 2016-06-27

Description:
Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.

Vendor: Cybozu
Product: Garoon 
Version:
4.2.0
4.0.3
4.0.2
4.0.1
4.0.0
3.7.5
3.7.4
3.7.3
3.7.2
3.7.1
3.7.0

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
https://support.cybozu.com/ja-jp/article/8919
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000079
http://jvn.jp/en/jp/JVN25765762/index.html

Related CVE
CVE-2016-4873
The "Project" function in Cybozu Office 9.0.0 through 10.4.0 does not properly check access permissions, which allows remote authenticated users to alter project information.
CVE-2016-4874
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
CVE-2016-4869
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to obtain session information from users.
CVE-2016-4870
Cross-site scripting (XSS) vulnerability in "Schedule" function in Cybozu Office 9.0.0 through 10.4.0.
CVE-2016-4871
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
CVE-2016-4872
The "breadcrumb trail" component in Cybozu Office 9.0.0 through 10.4.0 allows remote authenticated users to read the names of closed projects.
CVE-2016-4866
Cross-site scripting (XSS) vulnerability in the "Project" function in Cybozu Office 9.0.0 through 10.4.0.
CVE-2016-4867
The "Project" function in Cybozu 9.0.0 through 10.4.0 allows remote authenticated users to read closed project information.

Copyright 2017, cxsecurity.com