Input validation error in Cybozu Garoon - CVE-2021-20768
Published: August 2, 2021
Vulnerability identifier: #VU55474
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-20768
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied input in Scheduler and MultiReport. A remote authenticated attacker can pass specially crafted input to the application and delete the data of Scheduler and MultiReport without the appropriate privilege
Affected software
Cybozu Garoon
How to mitigate CVE-2021-20768
Install updates from vendor's website.
Cybozu Garoon - update to 5.5.0