CVE-2015-5649

Estado: ModificadaAlta (7)—
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.
CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:S/C:C/I:P/A:N
Puntuación base: 7
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.24%
Percentil entre todas las CVEs puntuadas: 68
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Cybozu — Garoon
CWE

CWE-287
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-5649",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:C/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 7.8,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-10-08T20:59:00.097",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN38369032/index.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9176",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN38369032/index.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.cybozu.com/ja-jp/article/9176",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges."
    },
    {
      "lang": "es",
      "value": "Cybozu Garoon 3.x hasta la versión 3.7.5 y 4.x hasta la versión 4.0.3, no maneja correctamente peticiones de autenticación, lo que permite a usuarios remotos autenticados llevar a cabo ataques de inyección LDAP y, consecuentemente, eludir las restricciones destinadas al inicio de sesión u obtener información sensible mediante el aprovechamiento de ciertos privilegios del grupo administración."
    }
  ],
  "lastModified": "2026-06-17T00:29:30.780",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3BB615D-E485-4ADE-B77D-FA9FB676DA4D"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18C7B082-06A5-4AC8-91D4-C6E2835AB286"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAF17D9A-4A2D-4F15-B377-AC6F6B2896AB"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13F08BE5-2639-4581-A49C-854820B25763"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56525E34-BC26-4833-938F-F157B77D82CF"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5195BBDF-2153-4600-8308-110BE2A73816"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "921FEEAD-1C44-4E65-8912-102A31B3D0B2"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A70AA82-947D-49AC-9019-A1F06DF8ABBA"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F462AD2C-EF50-489D-99E0-EAA9D78D7D46"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A69FAED9-AC11-4D20-885B-FFA04995F1F9"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3D36285-4AEF-4EE8-8737-10E3B89D3F1C"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB7D6AFF-BA89-4CCB-8F29-75592E3BA8FA"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F181B9E-3613-42D4-92FA-3AA54BB10785"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2014154-4685-4A48-AA69-02D0C1C78ED2"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0121310-1C8A-4F3E-9C0C-B8EA37907C7F"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE55E26D-AC2D-4384-97BC-090737F2D100"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B042AA50-E923-4C84-8A94-85479A59F652"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B681C16-60F7-46B5-BD26-25F7DC9F5F47"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19694FDB-184D-4C09-BD72-BB7B96F6391D"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "595FBCBB-BC3F-4E18-AFBE-C95108C4CB2F"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:3.7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD33E00A-5082-42F4-81F5-4647BD602D31"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71CC4428-0CB4-497F-8274-52E6CC273D65"
            },
            {
              "criteria": "cpe:2.3:a:cybozu:garoon:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A428CA3-8FAF-4DEB-8D95-5E76098E83B6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}