{"id":"CVE-2021-20625","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-20625","generatedAt":"2026-10-27T23:43:51.387Z","title":"Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspecified vectors.","description":"Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to bypass access restriction and alter the data of Bulletin Board via unspecified vectors.","published":"2021-03-18T01:15:12.000Z","lastModified":"2026-06-17T03:34:09.000Z","status":"Modified","sourceIdentifier":"vultures@jpcert.or.jp","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cwe":[],"affected":["cybozu/office"],"epss":{"score":0.00673,"percentile":0.51849,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://jvn.jp/en/jp/JVN45797538/index.html","tags":["Third Party Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://kb.cybozu.support/article/36874/","tags":["Vendor Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/jp/JVN45797538/index.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://kb.cybozu.support/article/36874/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-20625","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}