CVE-2014-0821: SQL Injection

Published Feb 27, 2014

Updated

SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.

Affected Software

50 affected components

Cybozu Garoon=2.0-sp1

Cybozu Garoon=2.0-sp2

Cybozu Garoon=2.0-sp3

Cybozu Garoon=2.0-sp4

Cybozu Garoon=2.0-sp5

Cybozu Garoon=2.0-sp6

Cybozu Garoon=2.0.0

Cybozu Garoon=2.0.1

Cybozu Garoon=2.0.2

Cybozu Garoon=2.0.3

Cybozu Garoon=2.0.4

Cybozu Garoon=2.0.5

Cybozu Garoon=2.0.6

Cybozu Garoon=2.1

Cybozu Garoon=2.1-sp1

Cybozu Garoon=2.1-sp2

Cybozu Garoon=2.1-sp3

Cybozu Garoon=2.1.0

Cybozu Garoon=2.1.1

Cybozu Garoon=2.1.2

Cybozu Garoon=2.1.3

Cybozu Garoon=2.5

Cybozu Garoon=2.5-sp1

Cybozu Garoon=2.5-sp2

Cybozu Garoon=2.5-sp3

Cybozu Garoon=2.5-sp4

Cybozu Garoon=2.5.0

Cybozu Garoon=2.5.1

Cybozu Garoon=2.5.2

Cybozu Garoon=2.5.3

Cybozu Garoon=2.5.4

Cybozu Garoon=3.0

Cybozu Garoon=3.0-sp1

Cybozu Garoon=3.0-sp2

Cybozu Garoon=3.0-sp3

Cybozu Garoon=3.1

Cybozu Garoon=3.1-sp1

Cybozu Garoon=3.1-sp2

Cybozu Garoon=3.1-sp3

Cybozu Garoon=3.5

Cybozu Garoon=3.5-sp1

Cybozu Garoon=3.5-sp2

Cybozu Garoon=3.5-sp3

Cybozu Garoon=3.5-sp4

Cybozu Garoon=3.5-sp5

Cybozu Garoon=3.5.3

Cybozu Garoon=3.7

Cybozu Garoon=3.7-sp1

Cybozu Garoon=3.7-sp2

Cybozu Garoon=3.7-sp3

Event History

Feb 27, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:55 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0821?

CVE-2014-0821 has a severity rating that indicates it can be exploited by remote authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2014-0821?

To fix CVE-2014-0821, upgrade Cybozu Garoon to a version that is not affected by this vulnerability, as specified in the vendor's security updates.

What versions of Cybozu Garoon are affected by CVE-2014-0821?

CVE-2014-0821 affects Cybozu Garoon versions 2.x through 2.5.4 and 3.x through 3.7 SP3.

Who can exploit CVE-2014-0821?

CVE-2014-0821 can be exploited by remote authenticated users of Cybozu Garoon.

What is SQL injection in the context of CVE-2014-0821?

SQL injection in the context of CVE-2014-0821 refers to the ability of an attacker to send malicious SQL queries through the download feature of Cybozu Garoon.