CVE-2012-4011

Published: Sep 8, 2012Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.

Affected (1)

Products: Cybozu: Kunai

Cybozu

1 product

Kunai

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cybozu Kunai	Up to 2.0.5

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (6)

http://cs.cybozu.co.jp/information/20120910up01.php

Source: vultures@jpcert.or.jp

Vendor Advisory

http://jvn.jp/en/jp/JVN23568423/index.html

Source: vultures@jpcert.or.jp

http://jvndb.jvn.jp/jvndb/JVNDB-2012-000083

Source: vultures@jpcert.or.jp

http://cs.cybozu.co.jp/information/20120910up01.php

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://jvn.jp/en/jp/JVN23568423/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://jvndb.jvn.jp/jvndb/JVNDB-2012-000083

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.