Information disclosure in Cybozu Mailwise

1) Information disclosure

EUVDB-ID: #VU42664

Risk: Low

CVSSv3.1: 1.3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-4698

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Mailwise: 5.0.4 - 5.0.5

External links

http://cs.cybozu.co.jp/information/20130812up02.php
http://jvn.jp/en/jp/JVN21103639/374951/index.html
http://jvn.jp/en/jp/JVN21103639/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000077

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to perform certain actions on the device.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.