VulnerabilityModified

CVE-2013-6929

SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.

MEDIUM 6.5EPSS 1.55%

Does this matter?

Lower severity and a low EPSS score (1.55%). Track it; it rarely justifies an emergency change on its own.

Description

SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input.

CVSS 2.0: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 1.55% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: cybozu/garoon
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN60997973/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000124
https://support.cybozu.com/ja-jp/article/7889Vendor Advisory
http://jvn.jp/en/jp/JVN60997973/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000124
https://support.cybozu.com/ja-jp/article/7889Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.