PT-2014-3219 · Cybozu · Cybozu Garoon

Publicado 2014-01-29 · Atualizado 2014-02-21 · CVE-2013-6930

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 2.0.0 through 2.0.6 Cybozu Garoon versions 2.1.0 through 2.1.3 Cybozu Garoon versions 2.5.0 through 2.5.4 Cybozu Garoon versions 3.0.0 through 3.0.3 Cybozu Garoon versions 3.5.0 through 3.5.5 Cybozu Garoon versions 3.7.x before 3.7.3

Description The issue is related to a SQL injection vulnerability in the page-navigation implementation. This allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Recommendations For Cybozu Garoon versions 2.0.0 through 2.0.6, update to a version outside of this range. For Cybozu Garoon versions 2.1.0 through 2.1.3, update to a version outside of this range. For Cybozu Garoon versions 2.5.0 through 2.5.4, update to a version outside of this range. For Cybozu Garoon versions 3.0.0 through 3.0.3, update to a version outside of this range. For Cybozu Garoon versions 3.5.0 through 3.5.5, update to a version outside of this range. For Cybozu Garoon versions 3.7.x before 3.7.3, update to version 3.7.3 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-6930

Produtos afetados

Cybozu Garoon

Referências · 7

• http://jvn.jp/en/jp/JVN91153528/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6930 · Nota de Segurança
• http://cs.cybozu.co.jp/information/20140127up02.php · Aviso do Fabricante
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000010 · Nota
• http://jvn.jp/en/jp/JVN91153528/374951/index.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6930 · Nota
• https://support.cybozu.com/ja-jp/article/7886 · Aviso do Fabricante