CVE-2013-2305: CSRF
First published: Thu Apr 25 2013(Updated: )
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that change passwords.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cybozu Office | <=8 | |
| Cybozu Office | =6 | |
| Cybozu Office | =7 | |
| Cybozu Office | =9 | |
| Cybozu Office | =9.2.1 | |
| Cybozu Dezie | <=8.0.6 | |
| Cybozu Dezie | =8.0.0 | |
| Cybozu Dezie | =8.0.1 | |
| Cybozu Dezie | =8.0.2 | |
| Cybozu Dezie | =8.0.3 | |
| Cybozu Dezie | =8.0.4 | |
| Cybozu Dezie | =8.0.5 | |
| Cybozu Mailwise | <=5.0 | |
| Cybozu Mailwise | =1.0 | |
| Cybozu Mailwise | =2.0 | |
| Cybozu Mailwise | =2.1 | |
| Cybozu Mailwise | =3.0 | |
| Cybozu Mailwise | =3.0\(0.2\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-2305?
CVE-2013-2305 has a medium severity rating due to its potential for CSRF attacks that can compromise user sessions.
How do I fix CVE-2013-2305?
To fix CVE-2013-2305, users should upgrade Cybozu Office to version 8.1.6 or later, Cybozu Dezie to version 8.0.7 or later, and Cybozu Mailwise to version 5.0.4 or later.
What software is affected by CVE-2013-2305?
CVE-2013-2305 affects Cybozu Office versions prior to 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4.
Can CVE-2013-2305 lead to unauthorized access?
Yes, CVE-2013-2305 can lead to unauthorized access as it allows attackers to hijack user authentication for password changes.
Is there a patch for CVE-2013-2305?
Yes, patches are available in the form of software updates for the affected versions of Cybozu products.
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- vendor/cybozu
- canonical/cybozu office
- version/cybozu office/8
- version/cybozu office/6
- version/cybozu office/7
- version/cybozu office/9
- version/cybozu office/9.2.1
- canonical/cybozu dezie
- version/cybozu dezie/8.0.6
- version/cybozu dezie/8.0.0
- version/cybozu dezie/8.0.1
- version/cybozu dezie/8.0.2
- version/cybozu dezie/8.0.3
- version/cybozu dezie/8.0.4
- version/cybozu dezie/8.0.5
- canonical/cybozu mailwise
- version/cybozu mailwise/5.0
- version/cybozu mailwise/1.0
- version/cybozu mailwise/2.0
- version/cybozu mailwise/2.1
- version/cybozu mailwise/3.0
- version/cybozu mailwise/3.0\(0.2\)