PT-2024-28682 · Cybozu · Cybozu Office

Published 2024-08-06 · Updated 2024-09-11 · CVE-2024-39817

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cybozu Office versions 10.0.0 through 10.8.6

Description The issue allows a user who can login to the product to view data that the user does not have access to by conducting 'search' under certain conditions in Custom App. This is due to the insertion of sensitive information into sent data.

Recommendations For Cybozu Office versions 10.0.0 through 10.8.6, consider restricting access to the Custom App search function until a patch is available. As a temporary workaround, limit user privileges to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-39817

Affected Products

Cybozu Office

References · 6

• https://osv.dev/vulnerability/CVE-2024-39817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39817 · Security Note
• https://kb.cybozu.support/?product=office&v=&fv=10.8.7&t=%E8%84%86%E5%BC%B1%E6%80%A7&s= · Vendor Advisory
• https://t.me/cvenotify/89349 · Telegram Post
• https://t.me/cvedetector/2529 · Telegram Post
• https://jvn.jp/en/jp/JVN29845579 · Note