CVE-2016-4868: Input Validation
Published Apr 17, 2017
·Updated
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
Affected Software
16 affected components
Cybozu Office=9.0
Cybozu Office=9.1.0
Cybozu Office=9.2.0
Cybozu Office=9.2.1
Cybozu Office=9.3.0
Cybozu Office=9.3.1
Cybozu Office=9.3.2
Cybozu Office=9.9.0
Cybozu Office=10.0.0
Cybozu Office=10.0.1
Cybozu Office=10.0.2
Cybozu Office=10.1.0
Cybozu Office=10.1.2
Cybozu Office=10.2.0
Cybozu Office=10.3.0
Cybozu Office=10.4.0
Event History
Apr 17, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4868?
CVE-2016-4868 is considered a medium severity vulnerability.
2
How do I fix CVE-2016-4868?
To fix CVE-2016-4868, you should update Cybozu Office to a version higher than 10.4.0.
3
What types of attacks can CVE-2016-4868 enable?
CVE-2016-4868 can enable remote attackers to inject arbitrary email headers and send unauthorized emails.
4
Which versions of Cybozu Office are affected by CVE-2016-4868?
CVE-2016-4868 affects Cybozu Office versions from 9.0.0 to 10.4.0.
5
Is CVE-2016-4868 exploitable remotely?
Yes, CVE-2016-4868 is exploitable remotely through specially crafted requests.