Cybozu Garoon vulnerable to LDAP injection


Cybozu Garoon is a groupware. Cybozu Garoon contains an issue in processing authentication requests, which may result in an LDAP injection vulnerability.
CVSS Severity (What is CVSS?)

Base Metrics: 7.0 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Partial
  • Availability Impact: None

Affected Products

Cybozu, Inc.
  • Cybozu Garoon 3.0.0 to 4.0.3


A malicious user authorized to administer uesrs in certain groups may obtain information from the authentication server or may perform an unauthorized login to the product.

[Apply the Patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Cybozu, Inc.
CWE (What is CWE?)

  1. No Mapping(CWE-noinfo) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2015-5649

  1. JVN : JVN#38369032
  2. National Vulnerability Database (NVD) : CVE-2015-5649
  3. IPA SECURITY ALERTS : Security Alert for Vulnerability in Cybozu Garoon (JVN#38369032) (in Japanese)
Revision History

  Web page was published
  References : Content was added