CVE-2014-1992: XSS
Published Jul 20, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the Messages functionality in Cybozu Garoon 3.1.x, 3.5.x, and 3.7.x before 3.7 SP4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
13 affected components
Cybozu Garoon=3.1.0
Cybozu Garoon=3.1.1
Cybozu Garoon=3.1.2
Cybozu Garoon=3.1.3
Cybozu Garoon=3.5.0
Cybozu Garoon=3.5.1
Cybozu Garoon=3.5.2
Cybozu Garoon=3.5.3
Cybozu Garoon=3.5.4
Cybozu Garoon=3.5.5
Cybozu Garoon=3.7-sp1
Cybozu Garoon=3.7-sp2
Cybozu Garoon=3.7-sp3
Event History
Jul 20, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-1992?
CVE-2014-1992 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-1992?
To mitigate CVE-2014-1992, users should upgrade to Cybozu Garoon version 3.7 SP4 or later.
3
What software is affected by CVE-2014-1992?
CVE-2014-1992 affects Cybozu Garoon versions 3.1.x, 3.5.x, and 3.7.x prior to version 3.7 SP4.
4
What kind of vulnerability is CVE-2014-1992?
CVE-2014-1992 is a cross-site scripting (XSS) vulnerability that allows injection of arbitrary web scripts or HTML.
5
Who can exploit CVE-2014-1992?
CVE-2014-1992 can be exploited by remote authenticated users of the affected Cybozu Garoon applications.