PT-2024-24051 · Cybozu · Cybozu Garoon

Published 2024-06-11 · Updated 2024-06-11 · CVE-2024-31404

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 5.5.0 through 6.0.0

Description The issue exists in Cybozu Garoon, where an insertion of sensitive information into sent data may allow a user who can log in to the product to view the data of Scheduler.

Recommendations For Cybozu Garoon versions 5.5.0 through 6.0.0, consider restricting access to the Scheduler data until a fix is available. As a temporary workaround, limit user permissions to minimize the risk of sensitive information exposure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-31404

Affected Products

Cybozu Garoon

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-31404 · Security Note
• https://cs.cybozu.co.jp/2024/007901.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31404 · Vendor Advisory
• https://jvn.jp/en/jp/JVN28869536 · Note
• https://t.me/cvenotify/82728 · Telegram Post