PT-2023-2935 · Cybozu · Cybozu Garoon

CVE-2023-27304 · Publicado 2023-05-12 · Atualizado 2025-01-17

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.6.0 through 5.9.2

Description The issue is related to an operation restriction bypass vulnerability in the Message and Bulletin components of Cybozu Garoon. This vulnerability is associated with weaknesses in the authorization procedure, allowing a remote authenticated attacker to alter the data of Message and/or Bulletin, thus impacting the integrity of protected information.

Recommendations For Cybozu Garoon versions 4.6.0 through 5.9.2, update to a version that includes a fix for the operation restriction bypass vulnerability in the Message and Bulletin components. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Missing Authorization

Enumeração de Fraquezas

CWE-285

CWE-862

Identificadores relacionados

BDU:2023-02932

CVE-2023-27304

Produtos afetados

Cybozu Garoon

Referências · 8

• https://t.me/cvenotify/50947 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27304 · Nota de Segurança
• https://kb.cybozu.support/article/38259 · Nota
• https://jvn.jp/en/jp/JVN41694426 · Nota
• https://bdu.fstec.ru/vul/2023-02932 · Nota de Segurança
• https://cs.cybozu.co.jp/2023/007698.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-27304 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2023051506 · Nota