PT-2020-18556 · Cybozu · Cybozu Garoon

Tanghaifeng · Published 2020-06-30 · Updated 2021-07-21 · CVE-2020-5582

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 4.0.0 through 5.0.1

Description The issue allows remote authenticated attackers to bypass access restrictions and alter data for files attached to reports. The exact vectors used for this bypass are not specified.

Recommendations For versions 4.0.0 through 5.0.1, consider restricting access to the report attachment feature until a patch is available. As a temporary workaround, limit the ability to alter file data attached to reports to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-5582

Affected Products

Cybozu Garoon

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-5582 · Security Note
• https://kb.cybozu.support/article/36455 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5582 · Vendor Advisory
• https://t.me/cvenotify/4732 · Telegram Post
• https://jvn.jp/en/jp/JVN55497111/index.html · Note