Main Vulnerability Database SB2017042015

SB2017042015 - Multiple vulnerabilities in Cybozu Mailwise

Published: April 20, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017042015

Severity

Medium

Patch available

YES

Number of vulnerabilities 4

Exploitation vector Remote access

Highest impact Information disclosure

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2016-4841)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.

2) Information disclosure (CVE-ID: CVE-2016-4842)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.

3) Information disclosure (CVE-ID: CVE-2016-4843)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.

4) Information disclosure (CVE-ID: CVE-2016-4844)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.

Install update from vendor's website.