PT-2024-28502 · Cybozu · Cybozu Garoon

Masato Kinugawa · Published 2024-07-19 · Updated 2024-08-22 · CVE-2024-39457

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 6.0.0 through 6.0.1

Description The issue is related to a cross-site scripting vulnerability in the PDF preview feature. If exploited, this could allow an arbitrary script to be executed on a logged-in user's web browser.

Recommendations For Cybozu Garoon versions 6.0.0 through 6.0.1, consider disabling the PDF preview feature until a patch is available to prevent potential script execution on a user's web browser.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-39457

Affected Products

Cybozu Garoon

References · 6

• https://osv.dev/vulnerability/CVE-2024-39457 · Vendor Advisory
• https://kb.cybozu.support/?product=garoon&v=&fv=6.0.2&t=%E8%84%86%E5%BC%B1%E6%80%A7&f=&r=&b=&s=&posts_per_page=20 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39457 · Security Note
• https://t.me/cvenotify/86710 · Telegram Post
• https://jvn.jp/en/jp/JVN74825766 · Note
• https://t.me/cvedetector/1205 · Telegram Post