« Volver al listado

CVE-2016-4872

Estado: ModificadaMedia (4.3)—

Cybozu Office versiones 9.0.0 hasta 10.4.0, permite a los atacantes autenticados remotos omitir las restricciones de acceso para visualizar los nombres de proyectos no autorizados por medio de una ruta de navegación previa (breadcrumb).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cybozu — Office

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4872",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-04-17T15:59:00.447",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN07148816/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000188.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://www.securityfocus.com/bid/93461",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9424",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN07148816/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000188.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/93461",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9424",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail."
    },
    {
      "lang": "es",
      "value": "Cybozu Office versiones 9.0.0 hasta 10.4.0, permite a los atacantes autenticados remotos omitir las restricciones de acceso para visualizar los nombres de proyectos no autorizados por medio de una ruta de navegación previa (breadcrumb)."
    }
  ],
  "lastModified": "2026-06-17T00:48:22.207",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B029709C-5ED7-4F29-8DA9-AFF9D678429F"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9AE0F63-8DD1-4F61-B772-E4F64197A73F"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27E1F1BC-4FF8-4438-92C2-5094F18BAB27"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C71A2292-BEEF-4449-992C-B8535E0EF969"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4B07F75-4F29-4241-9C5A-F723EAFCFC49"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ADEDCD4-8794-42A3-961A-9CE562BF64CA"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CF1B981-0417-430F-9BB3-7292D297557E"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:9.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59BDE89C-C891-4517-877D-26B5E4D87E0B"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F02CF334-548D-4B9B-8732-A85D97E003C5"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A968E493-5C74-45FB-BA4E-C21D66613480"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89D06E58-28D5-43E9-87CD-9534DF3CA6DA"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86DD19B-9DD2-412D-B259-9D2677C9CC0B"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EE0A58F-3DAF-4E88-A7CC-E1FE749EB6A2"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BF85C6A-952B-4327-98EF-BB72CA6AA5CE"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "664B383F-3C96-406C-B0B9-041F26F1F5A9"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBA465B8-3852-4630-B16C-120F77DB1F8C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}