PT-2014-4410 · Cybozu · Cybozu Garoon

Published 2014-05-02 · Updated 2014-05-02 · CVE-2014-1989

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 3.0 through 3.7 SP3

Description The issue allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.

Recommendations For versions 3.0 through 3.7 SP3, update to a version that contains a fix for this issue to prevent unauthorized deletion of schedule information.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1989

Affected Products

Cybozu Garoon

References · 5

• https://support.cybozu.com/ja/article/5264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1989 · Security Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1989 · Note
• http://jvn.jp/en/jp/JVN31230946/index.html · Note