#VU27331 Improper Authentication in Cybozu Garoon - CVE-2020-5563

Vulnerability identifier: #VU27331

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-5563

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cybozu Garoon
Web applications / Other software

Vendor: Cybozu

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in authentication process. A remote attacker with access to the API provided by the product can bypass authentication process and gain unauthorized access to sensitive information on the target systen.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Cybozu Garoon: 4.0.0 - 4.10.3

---

External links
https://jvn.jp/en/jp/JVN35649781/index.html
https://kb.cybozu.support/article/36118/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.