VulnerabilityModified
CVE-2014-0817
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
MEDIUM 4.9EPSS 0.96%
Does this matter?
Lower severity and a low EPSS score (0.96%). Track it; it rarely justifies an emergency change on its own.
Description
Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.
- CVSS 2.0
- 4.9 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- cybozu/garoon
- Source
- vultures@jpcert.or.jp
References
- http://cs.cybozu.co.jp/information/gr20140225up03.phpVendor Advisory
- http://jvn.jp/en/jp/JVN24035499/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021
- https://support.cybozu.com/ja-jp/article/7992Patch, Vendor Advisory
- http://cs.cybozu.co.jp/information/gr20140225up03.phpVendor Advisory
- http://jvn.jp/en/jp/JVN24035499/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021
- https://support.cybozu.com/ja-jp/article/7992Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.