CVE-2016-4866: XSS
Published Apr 17, 2017
·Updated
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function.
Affected Software
16 affected components
Cybozu Office=9.0
Cybozu Office=9.1.0
Cybozu Office=9.2.0
Cybozu Office=9.2.1
Cybozu Office=9.3.0
Cybozu Office=9.3.1
Cybozu Office=9.3.2
Cybozu Office=9.9.0
Cybozu Office=10.0.0
Cybozu Office=10.0.1
Cybozu Office=10.0.2
Cybozu Office=10.1.0
Cybozu Office=10.1.2
Cybozu Office=10.2.0
Cybozu Office=10.3.0
Cybozu Office=10.4.0
Event History
Apr 17, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4866?
CVE-2016-4866 is classified as a medium severity cross-site scripting vulnerability.
2
How do I fix CVE-2016-4866?
To fix CVE-2016-4866, upgrade Cybozu Office to a version later than 10.4.0 or apply the latest security patches provided by Cybozu.
3
Who is impacted by CVE-2016-4866?
CVE-2016-4866 affects installations of Cybozu Office versions 9.0.0 to 10.4.0 with administrator rights.
4
What type of vulnerability is CVE-2016-4866?
CVE-2016-4866 is a cross-site scripting (XSS) vulnerability that allows arbitrary web script or HTML injection.
5
Can CVE-2016-4866 be exploited remotely?
Yes, CVE-2016-4866 can be exploited remotely by attackers who gain administrator access.