CVE-2017-2256: XSS
Published Aug 28, 2017
·Updated
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Memo".
Affected Software
29 affected components
Cybozu Garoon=3.0.0
Cybozu Garoon=3.0.1
Cybozu Garoon=3.0.2
Cybozu Garoon=3.0.3
Cybozu Garoon=3.1.0
Cybozu Garoon=3.1.1
Cybozu Garoon=3.1.2
Cybozu Garoon=3.1.3
Cybozu Garoon=3.5.0
Cybozu Garoon=3.5.1
Cybozu Garoon=3.5.2
Cybozu Garoon=3.5.3
Cybozu Garoon=3.5.4
Cybozu Garoon=3.5.5
Cybozu Garoon=3.7.0
Cybozu Garoon=3.7.1
Cybozu Garoon=3.7.2
Cybozu Garoon=3.7.3
Cybozu Garoon=3.7.4
Cybozu Garoon=3.7.5
Cybozu Garoon=4.0.1
Cybozu Garoon=4.0.2
Cybozu Garoon=4.0.3
Cybozu Garoon=4.2.0
Cybozu Garoon=4.2.1
Cybozu Garoon=4.2.2
Cybozu Garoon=4.2.3
Cybozu Garoon=4.2.4
Cybozu Garoon=4.2.5
Event History
Aug 28, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-2256?
CVE-2017-2256 is categorized as a medium severity vulnerability.
2
How do I fix CVE-2017-2256?
To fix CVE-2017-2256, upgrade to Cybozu Garoon version 4.2.6 or later.
3
What type of vulnerability is CVE-2017-2256?
CVE-2017-2256 is a cross-site scripting (XSS) vulnerability.
4
Which versions of Cybozu Garoon are affected by CVE-2017-2256?
CVE-2017-2256 affects Cybozu Garoon versions from 3.0.0 to 4.2.5.
5
What can attackers do with CVE-2017-2256?
Attackers can inject arbitrary web scripts or HTML via the 'Rich text' function in the 'Memo' application.