PT-2020-18537 · Ntt Communications+1 · V-Cube Meeting+1

Kanta Nishitani · Published 2020-04-28 · Updated 2020-05-01 · CVE-2020-5562

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.6.0 through 4.6.3

Description A server-side request forgery (SSRF) issue allows a remote attacker with administrative privileges to issue arbitrary HTTP requests to other web servers via the V-CUBE Meeting function. This enables the attacker to potentially access or manipulate sensitive data on other web servers.

Recommendations For Cybozu Garoon versions 4.6.0 through 4.6.3, consider restricting access to the V-CUBE Meeting function until a patch is available to prevent exploitation of the SSRF issue. As a temporary workaround, limit the administrative privileges to minimize the risk of arbitrary HTTP requests being issued to other web servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-5562

Affected Products

Cybozu Garoon

V-Cube Meeting

References · 5

• https://kb.cybozu.support/article/36304 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5562 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5562 · Vendor Advisory
• https://jvn.jp/en/jp/JVN58849431/index.html · Note
• https://t.me/cvenotify/3297 · Telegram Post