PT-2021-14255 · Cybozu+1 · Cybozu Remote Service+1

Published 2021-10-13 · Updated 2021-10-19 · CVE-2021-20801

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cybozu Remote Service versions 3.1.8 through 3.1.9

Description: The issue allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks. This can lead to obtaining the information stored in the product. The attack is possible via unspecified vectors, but it only occurs when using Mozilla Firefox.

Recommendations: For Cybozu Remote Service versions 3.1.8 through 3.1.9, consider disabling the use of Mozilla Firefox until a patch is available. As a temporary workaround, restrict access to sensitive information stored in the product to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-20801

Affected Products

Cybozu Remote Service

Firefox

References · 4

• https://osv.dev/vulnerability/CVE-2021-20801 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20801 · Security Note
• https://kb.cybozu.support/article/37423 · Vendor Advisory
• https://jvn.jp/en/jp/JVN52694228/index.html · Note