PT-2006-5290 · Cybozu · Cybozu Office+1

Tan Chew Keong · Published 2006-08-31 · Updated 2017-07-20 · CVE-2006-4490

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Office versions prior to 6.6 Build 1.3 Cybozu Share 360 versions prior to 2.5 Build 0.3

Description The issue allows remote authenticated users to read arbitrary files via a .. (dot dot) sequence in the id parameter. This can be exploited through scripts in (1) cbag/ag.exe or (2) s360v2/s360.exe.

Recommendations For Cybozu Office versions prior to 6.6 Build 1.3, update to version 6.6 Build 1.3 or later. For Cybozu Share 360 versions prior to 2.5 Build 0.3, update to version 2.5 Build 0.3 or later.

Exploit

Fix

Related Identifiers

CVE-2006-4490

Affected Products

Cybozu Office

Cybozu Share 360

References · 11

• 🔥 https://exploit-db.com/exploits/2266 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4490 · Security Note
• http://secunia.com/advisories/21623 · Vendor Advisory
• http://secunia.com/advisories/21618 · Vendor Advisory
• http://cybozu.co.jp/products/dl/notice_060825 · Note
• http://jvn.jp/jp/JVN%2390420168/index.html · Note
• http://securitytracker.com/id?1016759 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28591 · Note
• http://vuln.sg/cybozu-en.html · Note
• http://osvdb.org/28261 · Note
• http://osvdb.org/28262 · Note