VulnerabilityModified

CVE-2014-1989

Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.

MEDIUM 6.0EPSS 1.06%

Does this matter?

Lower severity and a low EPSS score (1.06%). Track it; it rarely justifies an emergency change on its own.

Description

Cybozu Garoon 3.0 through 3.7 SP3 allows remote authenticated users to bypass intended access restrictions and delete schedule information via unspecified API calls.

CVSS 2.0: 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS: 1.06% probability · 63th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: cybozu/garoon
Source: vultures@jpcert.or.jp

References

http://jvn.jp/en/jp/JVN31230946/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043
https://support.cybozu.com/ja/article/5264Vendor Advisory
http://jvn.jp/en/jp/JVN31230946/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000043
https://support.cybozu.com/ja/article/5264Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.