PT-2014-4405 · Cybozu · Cybozu Remote Service Manager

Published 2014-04-19 · Updated 2019-07-16 · CVE-2014-1984

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cybozu Remote Service Manager versions prior to 3.1.1 Cybozu Remote Service Manager version 2.3.0

Description A session fixation issue in the management screen allows remote attackers to hijack web sessions.

Recommendations For version 2.3.0, update to version 3.1.1 or later. For versions 3.x prior to 3.1.1, update to version 3.1.1 or later. As a temporary workaround, consider restricting access to the management screen until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-1984

Affected Products

Cybozu Remote Service Manager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-1984 · Security Note
• http://cs.cybozu.co.jp/information/20130317notice02.php · Vendor Advisory
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000040 · Note
• http://jvn.jp/en/jp/JVN00058727/index.html · Note