[Japanese]

JVNDB-2015-000152

Cybozu Garoon vulnerable to LDAP injection

Overview

Cybozu Garoon is a groupware. Cybozu Garoon contains an issue in processing authentication requests, which may result in an LDAP injection vulnerability.
CVSS Severity (What is CVSS?)

Base Metrics: 7.0 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Partial
  • Availability Impact: None

Affected Products


Cybozu, Inc.
  • Cybozu Garoon 3.0.0 to 4.0.3

Impact

A malicious user authorized to administer uesrs in certain groups may obtain information from the authentication server or may perform an unauthorized login to the product.
Solution

[Apply the Patch]
Apply the appropriate patch according to the information provided by the developer.
Vendor Information

Cybozu, Inc.
CWE (What is CWE?)

  1. No Mapping(CWE-noinfo) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2015-5649
References

  1. JVN : JVN#38369032
  2. National Vulnerability Database (NVD) : CVE-2015-5649
  3. IPA SECURITY ALERTS : Security Alert for Vulnerability in Cybozu Garoon (JVN#38369032) (in Japanese)
Revision History

[2015/10/07]
  Web page was published
[2015/10/13]
  References : Content was added