JVNDB-2009-000067

Multiple Cybozu products vulnerable to cross-site scripting

Multiple Cybozu products are vulnerable to cross-site scripting.

Multiple products (groupware etc.) provided by Cybozu, Inc. contain a cross-site scripting vulnerablility.

This vulnerability is different from JVN#50342989, and JVN#90712589.

Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

Cybozu, Inc.

• Cybozu Office 7
• Cybozu Dezie 6
• Cybozu Mailwise 3

An arbitrary script may be executed on the user's web browser.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Cybozu, Inc.

• Cybozu : CY09-10-001 (Japanese)

1. Cross-site Scripting(CWE-79) [IPA Evaluation]

1. JVN : JVN#23108985
2. Secunia Advisory : SA37011
3. SecurityFocus : 36704
4. VUPEN Security : VUPEN/ADV-2009-2918

[2009/10/15]
  Web page published