CVE-2015-5649: High severity cybozu garoon vulnerability

Published Oct 8, 2015

Updated

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.

Affected Software

23 affected components

Cybozu Garoon=3.0.0

Cybozu Garoon=3.0.1

Cybozu Garoon=3.0.2

Cybozu Garoon=3.0.3

Cybozu Garoon=3.1.0

Cybozu Garoon=3.1.1

Cybozu Garoon=3.1.2

Cybozu Garoon=3.1.3

Cybozu Garoon=3.5.0

Cybozu Garoon=3.5.1

Cybozu Garoon=3.5.2

Cybozu Garoon=3.5.3

Cybozu Garoon=3.5.4

Cybozu Garoon=3.5.5

Cybozu Garoon=3.7-sp1

Cybozu Garoon=3.7-sp2

Cybozu Garoon=3.7-sp3

Cybozu Garoon=3.7.0

Cybozu Garoon=3.7.1

Cybozu Garoon=3.7.2

Cybozu Garoon=3.7.3

Cybozu Garoon=4.0.0

Cybozu Garoon=4.0.3

Event History

Oct 8, 2015

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5649?

CVE-2015-5649 has a medium severity level due to its potential for LDAP injection attacks and unauthorized access to sensitive information.

How do I fix CVE-2015-5649?

To mitigate CVE-2015-5649, update Cybozu Garoon to version 4.0.4 or later, which addresses the authentication mishandling issue.

What are the affected versions of CVE-2015-5649?

CVE-2015-5649 affects Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3.

Who can exploit CVE-2015-5649?

CVE-2015-5649 can be exploited by remote authenticated users with certain group-administration privileges.

What kind of attack can CVE-2015-5649 facilitate?

CVE-2015-5649 can facilitate LDAP injection attacks, leading to login restriction bypass and potential data leakage.