« Volver al listado

CVE-2017-2145

Estado: ModificadaMedia (5.4)—

Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cybozu — Garoon

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-2145",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Cybozu, Inc.",
          "product": "Cybozu Garoon",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0 to 4.2.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-07T13:29:00.227",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN43534286/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9695",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN43534286/index.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9695",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Session fixation vulnerability in Cybozu Garoon 4.0.0 to 4.2.4 allows remote attackers to perform arbitrary operations via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de fijación de sesión en Cybozu Garoon desde las versiones 4.0.0 hasta las 4.2.4 permite que atacantes remotos realicen operaciones arbitrarias mediante vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-17T01:15:38.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71CC4428-0CB4-497F-8274-52E6CC273D65"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42A63B4B-0248-46B0-B0FB-7DBDD48DAA80"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4C3A49A-0C9C-4E43-B99C-2C28A12A8A09"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A428CA3-8FAF-4DEB-8D95-5E76098E83B6"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A9EABAA-964A-4242-939A-378B03A1F150"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9487784-3EF9-4B11-A831-5F3D35BC716E"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B03D1A99-E1D3-4400-856C-62F2961E41FE"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4165B99C-EE50-4151-90AF-CE1F71E86D2A"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F6C3FA5-801C-440F-A755-6BC9BB04EB4F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}