CVE-2020-5562

Published: Apr 28, 2020Modified: Nov 21, 2024

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

Server-side request forgery (SSRF) vulnerability in Cybozu Garoon 4.6.0 to 4.6.3 allows a remote attacker with an administrative privilege to issue arbitrary HTTP requests to other web servers via V-CUBE Meeting function.

Affected (1)

Products: Cybozu: Garoon

Cybozu

1 product

Garoon

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cybozu Garoon	From 4.6.0 to 4.6.3

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://jvn.jp/en/jp/JVN58849431/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://kb.cybozu.support/article/36304

Source: vultures@jpcert.or.jp

Vendor Advisory

https://jvn.jp/en/jp/JVN58849431/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://kb.cybozu.support/article/36304

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.