« Volver al listado

CVE-2017-10857

Estado: ModificadaMedia (4.3)—

Cybozu Office desde la versión 10.0.0 hasta 10.6.1 permite que atacantes no autenticados omitan restricciones de acceso para realizar acciones arbitrarias mediante la función Cabinet.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cybozu — Office

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-10857",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Cybozu, Inc.",
          "product": "Cybozu Office",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0 to 10.6.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-12T14:29:00.217",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN14658424/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9811",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN14658424/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9811",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions via \"Cabinet\" function."
    },
    {
      "lang": "es",
      "value": "Cybozu Office desde la versión 10.0.0 hasta 10.6.1 permite que atacantes no autenticados omitan restricciones de acceso para realizar acciones arbitrarias mediante la función Cabinet."
    }
  ],
  "lastModified": "2026-06-17T01:00:49.767",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F02CF334-548D-4B9B-8732-A85D97E003C5"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A968E493-5C74-45FB-BA4E-C21D66613480"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89D06E58-28D5-43E9-87CD-9534DF3CA6DA"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A86DD19B-9DD2-412D-B259-9D2677C9CC0B"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1EE0A58F-3DAF-4E88-A7CC-E1FE749EB6A2"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BF85C6A-952B-4327-98EF-BB72CA6AA5CE"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "664B383F-3C96-406C-B0B9-041F26F1F5A9"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBA465B8-3852-4630-B16C-120F77DB1F8C"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "178094DD-30C6-49BF-A42A-4264FA5A61D5"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D59E18AD-EF62-48F6-8BFB-9598B3118301"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:office:10.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB43B837-6C4B-4FDE-99F8-6446378750AD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}