PT-2017-8562 · Cybozu · Cybozu Office

Published 2017-04-17 · Updated 2017-05-23 · CVE-2016-4865

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 9.0.0 through 10.4.0

Description A cross-site scripting issue allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.

Recommendations For Cybozu Office versions 9.0.0 through 10.4.0, consider disabling the Customapp function until a patch is available to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-4865

Affected Products

Cybozu Office

References · 6

• https://osv.dev/vulnerability/CVE-2016-4865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4865 · Security Note
• https://support.cybozu.com/ja-jp/article/9430 · Vendor Advisory
• http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000184.html · Note
• http://securityfocus.com/bid/93281 · Note
• http://jvn.jp/en/jp/JVN06726266/index.html · Note