CVE-2016-4870: XSS
Published Apr 17, 2017
·Updated
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function.
Affected Software
16 affected components
Cybozu Office=9.0
Cybozu Office=9.1.0
Cybozu Office=9.2.0
Cybozu Office=9.2.1
Cybozu Office=9.3.0
Cybozu Office=9.3.1
Cybozu Office=9.3.2
Cybozu Office=9.9.0
Cybozu Office=10.0.0
Cybozu Office=10.0.1
Cybozu Office=10.0.2
Cybozu Office=10.1.0
Cybozu Office=10.1.2
Cybozu Office=10.2.0
Cybozu Office=10.3.0
Cybozu Office=10.4.0
Event History
Apr 17, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-4870?
CVE-2016-4870 is classified as a high severity vulnerability due to its potential for exploitation via cross-site scripting.
2
How do I fix CVE-2016-4870?
To fix CVE-2016-4870, you should update Cybozu Office to a version that is not affected, specifically any version after 10.4.0.
3
What are the affected software versions for CVE-2016-4870?
CVE-2016-4870 affects Cybozu Office versions 9.0.0 to 10.4.0.
4
Can CVE-2016-4870 be exploited remotely?
Yes, CVE-2016-4870 can be exploited by remote authenticated attackers, allowing them to inject malicious scripts.
5
What type of vulnerability is CVE-2016-4870?
CVE-2016-4870 is a cross-site scripting (XSS) vulnerability.