Vulnerability Details : CVE-2014-0821
SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2013-6930 and CVE-2013-6931.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2014-0821
Probability of exploitation activity in the next 30 days: 0.26%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 65 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-0821
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
CWE ids for CVE-2014-0821
-
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0821
-
https://support.cybozu.com/ja-jp/article/7993
不具合情報公開サイトVendor Advisory
-
http://cs.cybozu.co.jp/information/gr20140225up04.php
ファイルダウンロード処理に関するSQLインジェクションの脆弱性【CY14-002-003】 | サイボウズからのお知らせVendor Advisory
-
http://jvn.jp/en/jp/JVN71045461/index.html
JVN#71045461: Cybozu Garoon vulnerable to SQL injectionVendor Advisory
-
http://www.securityfocus.com/bid/65809
Cybozu Garoon CVE-2014-0821 Unspecified SQL Injection Vulnerability
-
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000024
JVNDB-2014-000024 - JVN iPedia - 脆弱性対策情報データベースVendor Advisory
Products affected by CVE-2014-0821
- cpe:2.3:a:cybozu:garoon:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:sp4:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:sp5:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.7:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.7:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.7:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.5:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp5:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp4:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.1:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.0:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5:sp4:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5:sp2:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp6:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.1:sp3:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5:sp1:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:cybozu:garoon:3.7:sp3:*:*:*:*:*:*