SB2023051506 - Multiple vulnerabilities in Cybozu Garoon

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2023-26595)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Message. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Improper Authorization (CVE-ID: CVE-2023-27304)

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper authorization in Message and Bulletin. A remote user can alter the data of Message and/or Bulletin.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/jp/JVN41694426/index.html
• https://cs.cybozu.co.jp/2023/007698.html