CVE-2016-4865: XSS
Published Apr 17, 2017
·Updated
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.
Affected Software
16 affected components
Cybozu Office=9.0
Cybozu Office=9.1.0
Cybozu Office=9.2.0
Cybozu Office=9.2.1
Cybozu Office=9.3.0
Cybozu Office=9.3.1
Cybozu Office=9.3.2
Cybozu Office=9.9.0
Cybozu Office=10.0.0
Cybozu Office=10.0.1
Cybozu Office=10.0.2
Cybozu Office=10.1.0
Cybozu Office=10.1.2
Cybozu Office=10.2.0
Cybozu Office=10.3.0
Cybozu Office=10.4.0
Event History
Apr 17, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4865?
CVE-2016-4865 is classified as a medium severity Cross-Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2016-4865?
To fix CVE-2016-4865, upgrade Cybozu Office to a version that is not affected, specifically version 10.5.0 or later.
3
What types of attacks are possible with CVE-2016-4865?
CVE-2016-4865 can allow attackers to inject arbitrary web scripts or HTML into the application.
4
Who is affected by CVE-2016-4865?
CVE-2016-4865 affects administrators using Cybozu Office versions 9.0.0 through 10.4.0.
5
Is user interaction required for CVE-2016-4865 to be exploited?
Yes, user interaction may be required to trigger the exploit of CVE-2016-4865, as it relies on executing malicious scripts.