[Japanese]

JVNDB-2015-000151

Multiple PHP code execution vulnerabilitles in Cybozu Garoon

Overview

Cybozu Garoon is a groupware. Cybozu Garoon contains multiple PHP code execution vulnerabilities.

* [CyVDB-863] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code, [CyVDB-867] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code (CVE-2015-5646)
* [CyVDB-866] Cybozu Garoon allows remote authenticated users to execute arbitrary PHP code in RSS Reader function (CVE-2015-5647)

For more details, refer to the information provided by the developer.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 8.5 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Complete
  • Availability Impact: Complete
Affected Products


Cybozu, Inc.
  • Cybozu Garoon 3.0.0 to 4.0.3

Impact

An authenticated attacker may execute arbitrary PHP code on the application server.
Solution

[Apply the Patch]
Apply the appropriate patch according to the information provided by the developer.

[Added on May 30, 2016]
[Update the Software]
The developer has released the version that contains a fix for this vulnerability.
Update to the latest version according to the information provided by the developer.
Vendor Information

Cybozu, Inc.
CWE (What is CWE?)

  1. Code Injection(CWE-94) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2015-5646
  2. CVE-2015-5647
References

  1. JVN : JVN#21025396
  2. National Vulnerability Database (NVD) : CVE-2015-5646
  3. National Vulnerability Database (NVD) : CVE-2015-5647
  4. IPA SECURITY ALERTS : Security Alert for Vulnerability in Cybozu Garoon (JVN#21025396) (in Japanese)
Revision History

  • [2015/10/07]
      Web page was published
    [2015/10/14]
      References : Contents were added
    [2016/05/30]
      Solution was modified

Date Public2015/10/07
Date First Published2015/10/07
Date Last Updated2016/05/30