PT-2017-7944 · Cybozu · Cybozu Garoon

Published 2017-04-20 · Updated 2017-04-25 · CVE-2016-1219

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions prior to 4.2.2

Description The issue allows remote attackers to bypass login authentication. This is related to the use of API endpoints, though specific details about the endpoints, such as /api/v1/login, are not provided. The bypass is achieved through vectors related to API use, potentially involving vulnerable parameters or variables, but these are not explicitly specified.

Recommendations For versions prior to 4.2.2, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to API endpoints related to login authentication until the update can be applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2016-1219

Affected Products

Cybozu Garoon

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-1219 · Security Note
• https://support.cybozu.com/ja-jp/article/9408 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1219 · Vendor Advisory
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000148.html · Note
• http://jvn.jp/en/jp/JVN89211736/index.html · Note
• http://securityfocus.com/bid/92598 · Note