[Japanese]

JVNDB-2015-000151

Multiple PHP code execution vulnerabilitles in Cybozu Garoon

Overview

Cybozu Garoon is a groupware. Cybozu Garoon contains multiple PHP code execution vulnerabilities.

* [CyVDB-863] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code, [CyVDB-867] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code (CVE-2015-5646)
* [CyVDB-866] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code in RSS Reader function (CVE-2015-5647)

For more details, refer to the information provided by the developer.
CVSS Severity (What is CVSS?)

Base Metrics: 8.5 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Complete
  • Availability Impact: Complete

Affected Products


Cybozu, Inc.
  • Cybozu Garoon 3.0.0 to 4.0.3

Impact

An authenticated attacker may execute arbitrary PHP code on the application server.
Solution

[Apply the Patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Cybozu, Inc.
CWE (What is CWE?)

  1. Code Injection(CWE-94) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2015-5646
  2. CVE-2015-5647
References

  1. JVN : JVN#21025396
  2. National Vulnerability Database (NVD) : CVE-2015-5646
  3. National Vulnerability Database (NVD) : CVE-2015-5647
  4. IPA SECURITY ALERTS : Security Alert for Vulnerability in Cybozu Garoon (JVN#21025396) (in Japanese)
Revision History

[2015/10/07]
  Web page was published
[2015/10/14]
  References : Contents were added