|
[Japanese]
|
JVNDB-2025-000062
|
Multiple vulnerabilities in Group-Office
|
|
Group-Office provided by Intermesh BV contains multiple vulnerabilities listed below.
- Cross-site scripting (CWE-79) - CVE-2025-53504
- Path traversal (CWE-22) - CVE-2025-53505
Rikuto Tauchi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 5.4 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-53504
|
CVSS V3 Severity:
Base Metrics:4.3 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2025-53505
|
|
|
Intermesh BV
- Group-Office versions prior to 6.8.119
- Group-Office versions prior to 25.0.20
|
|
|
- An arbitrary script may be executed in the user's web browser (CVE-2025-53504)
- Information on the server hosting the product may be exposed (CVE-2025-53505)
|
|
[Update the Software]
Update the software to the latest version according to the information provided by the developer.
|
|
Intermesh BV
|
|
- Path Traversal(CWE-22) [IPA Evaluation]
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
|
- CVE-2025-53504
- CVE-2025-53505
|
|
- JVN : JVN#72111431
|
|
- [2025/08/21]
Web page was published
|
