PT-2013-5917 · Cybozu · Cybozu Garoon

Published 2013-12-28 · Updated 2013-12-30 · CVE-2013-6006

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.5 through 3.7 SP2

Description The issue allows remote attackers to bypass Keitai authentication. This is achieved by modifying the user ID in a request.

Recommendations For versions 3.5 through 3.7 SP2, consider restricting access to authentication mechanisms to minimize the risk of exploitation until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-6006

Affected Products

Cybozu Garoon

References · 5

• https://support.cybozu.com/ja-jp/article/7893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6006 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2013-000125 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6006 · Note
• http://jvn.jp/en/jp/JVN81706478/index.html · Note