by Kastro
Paper/Archive/CVE-2024-31401

CVE-2024-31401

Cybozu, Inc. Cybozu Garoon — Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privile…

EPSS 0.5%CVSS 9.0
critical.is priorityof 100
36
CVSS 9.0 (ADP)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 43.1.431 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product.

Affected

ProductAffectedFixed inSource
Cybozu Garoon5.0.0 to 5.15.2–CNA
garoon5.0.0 – 5.12.2–CISA-ADP

Scores by source

CISA ADP9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcs.cybozu.co.jp/2024/007901.htmlrefjvn.jp/en/jp/JVN28869536