CVE-2015-5647: Code Injection
Published Oct 12, 2015
·Updated
The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
Affected Software
24 affected components
Cybozu Garoon=3.0.0
Cybozu Garoon=3.0.1
Cybozu Garoon=3.0.2
Cybozu Garoon=3.0.3
Cybozu Garoon=3.1.0
Cybozu Garoon=3.1.1
Cybozu Garoon=3.1.2
Cybozu Garoon=3.1.3
Cybozu Garoon=3.5.0
Cybozu Garoon=3.5.1
Cybozu Garoon=3.5.2
Cybozu Garoon=3.5.3
Cybozu Garoon=3.5.4
Cybozu Garoon=3.5.5
Cybozu Garoon=3.7.0
Cybozu Garoon=3.7.1
Cybozu Garoon=3.7.2
Cybozu Garoon=3.7.3
Cybozu Garoon=3.7.4
Cybozu Garoon=3.7.5
Cybozu Garoon=4.0.0
Cybozu Garoon=4.0.1
Cybozu Garoon=4.0.2
Cybozu Garoon=4.0.3
Event History
Oct 12, 2015
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-5647?
CVE-2015-5647 has been classified as having a moderate severity level.
2
How do I fix CVE-2015-5647?
Fixing CVE-2015-5647 involves updating Cybozu Garoon to version 4.0.4 or later.
3
Who is affected by CVE-2015-5647?
CVE-2015-5647 affects all versions of Cybozu Garoon from 3.0.0 to 4.0.3.
4
What type of vulnerability is CVE-2015-5647?
CVE-2015-5647 is a remote code execution vulnerability due to arbitrary PHP code execution.
5
Can CVE-2015-5647 be exploited without authentication?
No, CVE-2015-5647 can only be exploited by remote authenticated users.