#VU55474 Input validation error in Cybozu Garoon - CVE-2021-20768

Vulnerability identifier: #VU55474

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-20768

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cybozu Garoon
Web applications / Other software

Vendor: Cybozu

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input in Scheduler and MultiReport. A remote authenticated attacker can pass specially crafted input to the application and delete the data of Scheduler and MultiReport without the appropriate privilege

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cybozu Garoon: 4.0.0 - 5.0.2

---

External links
https://jvn.jp/en/jp/JVN54794245/index.html
https://cs.cybozu.co.jp/2021/007206.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.