PT-2019-17947 · Cybozu · Cybozu Office

Shoji Baba · Published 2019-12-26 · Updated 2019-12-30 · CVE-2019-6022

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.8.3

Description A directory traversal issue allows remote authenticated attackers to modify arbitrary files using the Customapp function.

Recommendations For Cybozu Office versions 10.0.0 through 10.8.3, consider restricting access to the Customapp function until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-6022

Affected Products

Cybozu Office

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-6022 · Security Note
• https://kb.cybozu.support/article/36124 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6022 · Vendor Advisory
• http://jvn.jp/en/jp/JVN79854355/index.html · Note