VulnerabilityModified

CVE-2013-3646

The Cybozu Live application before 2.0.1 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

MEDIUM 6.8EPSS 1.99%

Does this matter?

Lower severity and a low EPSS score (1.99%). Track it; it rarely justifies an emergency change on its own.

Description

The Cybozu Live application before 2.0.1 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site. NOTE: this vulnerability exists because of a CVE-2012-4008 regression.

CVSS 2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 1.99% probability · 79th percentile
CISA KEV: Not listed
Weakness: CWE-17
Affected: cybozu/cybozu live
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN63428218/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000059
https://live.cybozu.co.jp/trouble.html?q=2530Vendor Advisory
http://jvn.jp/en/jp/JVN63428218/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000059
https://live.cybozu.co.jp/trouble.html?q=2530Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.