PT-2017-7944 · Cybozu · Cybozu Garoon

Publicado 2017-04-20 · Atualizado 2017-04-25 · CVE-2016-1219

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 4.2.2

Description The issue allows remote attackers to bypass login authentication. This is related to the use of API endpoints, though specific details about the endpoints, such as /api/v1/login, are not provided. The bypass is achieved through vectors related to API use, potentially involving vulnerable parameters or variables, but these are not explicitly specified.

Recommendations For versions prior to 4.2.2, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints related to login authentication until the update can be applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2016-1219

Produtos afetados

Cybozu Garoon

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-1219 · Nota de Segurança
• https://support.cybozu.com/ja-jp/article/9408 · Aviso do Fabricante
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000148.html · Nota
• https://osv.dev/vulnerability/CVE-2016-1219 · Aviso do Fabricante
• http://jvn.jp/en/jp/JVN89211736/index.html · Nota
• http://securityfocus.com/bid/92598 · Nota