製品・ソフトウェアに関する情報

JVN脆弱性詳細

サイボウズ Office におけるアクセス制限回避の脆弱性

Title	サイボウズ Office におけるアクセス制限回避の脆弱性
Summary	サイボウズ株式会社が提供するサイボウズ Office には、複数の機能にアクセス制限回避の脆弱性が存在します。
Possible impacts	遠隔の第三者によって、グループウェアの情報を閲覧される可能性があります。当該製品にログイン可能なユーザによって、本来アクセス不可能な情報を取得されたり、特定機能を操作不可能にされる可能性があります。
Solution	[アップデートする] 開発者が提供する情報をもとに、最新版へアップデートしてください。
Publication Date	Feb. 15, 2016, midnight
Registration Date	Feb. 15, 2016, 2:09 p.m.
Last Update	Feb. 23, 2016, 4:27 p.m.

CVSS3.0 : 警告
Score	5.4
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CVSS2.0 : 警告
Score	5.5
Vector	AV:N/AC:L/Au:S/C:P/I:N/A:P

Affected System

サイボウズ

サイボウズ Office 9.0.0 から 10.3.0 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8484	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8484
2	CVE-2015-8484	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8484
3	CVE-2015-8485	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8485
4	CVE-2015-8485	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8485
5	CVE-2015-8486	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8486
6	CVE-2015-8486	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8486
7	CVE-2016-1152	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1152
8	CVE-2016-1152	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1152
National Vulnerability Database (NVD)
9	CVE-2015-8484	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8484
10	CVE-2015-8484	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8484
11	CVE-2015-8485	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8485
12	CVE-2015-8485	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8485
13	CVE-2015-8486	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8486
14	CVE-2015-8486	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8486
15	CVE-2016-1152	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1152
16	CVE-2016-1152	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1152

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html
2	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
サイボウズからのお知らせ
1	ポップアップカレンダーに関する閲覧制限回避の脆弱性[CyVDB-745]	https://cs.cybozu.co.jp/2016/006110.html
2	ポップアップカレンダーに関する閲覧制限回避の脆弱性[CyVDB-745]	https://cs.cybozu.co.jp/2016/006110.html
3	作成者以外のユーザーが、公開前の掲示の標題を取得できてしまう【CyVDB-940】	https://cs.cybozu.co.jp/2015/006077.html
4	作成者以外のユーザーが、公開前の掲示の標題を取得できてしまう【CyVDB-940】	https://cs.cybozu.co.jp/2015/006077.html
5	参加者に含まれないユーザーが、非公開予定に含まれる情報を参照/操作できてしまう【CyVDB-978】	https://cs.cybozu.co.jp/2015/006076.html
6	参加者に含まれないユーザーが、非公開予定に含まれる情報を参照/操作できてしまう【CyVDB-978】	https://cs.cybozu.co.jp/2015/006076.html
7	特定の機能を利用して、非公開の報告書の標題が閲覧できてしまう【CyVDB-941】	https://cs.cybozu.co.jp/2015/006074.html
8	特定の機能を利用して、非公開の報告書の標題が閲覧できてしまう【CyVDB-941】	https://cs.cybozu.co.jp/2015/006074.html

その他

No	Name	URL
JVN
1	JVN#48720230	https://jvn.jp/jp/JVN48720230/index.html
2	JVN#48720230	https://jvn.jp/jp/JVN48720230/index.html

Change Log

No	Changed Details	Date of change
0	[2016年02月15日] 掲載 [2016年02月23日] 参考情報：National Vulnerability Database (NVD) (CVE-2015-8484) を追加参考情報：National Vulnerability Database (NVD) (CVE-2015-8485) を追加参考情報：National Vulnerability Database (NVD) (CVE-2015-8486) を追加参考情報：National Vulnerability Database (NVD) (CVE-2016-1152) を追加	Feb. 17, 2018, 10:37 a.m.
0	[2016年02月15日] 掲載 [2016年02月23日] 参考情報：National Vulnerability Database (NVD) (CVE-2015-8484) を追加参考情報：National Vulnerability Database (NVD) (CVE-2015-8485) を追加参考情報：National Vulnerability Database (NVD) (CVE-2015-8486) を追加参考情報：National Vulnerability Database (NVD) (CVE-2016-1152) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2015-8484

Summary	Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.
Publication Date	Feb. 17, 2016, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
2	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
3	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
4	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
5	https://cs.cybozu.co.jp/2016/006110.html	Vendor Advisory
6	https://cs.cybozu.co.jp/2016/006110.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

CVE-2015-8485

Summary	Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8486, and CVE-2016-1152.
Publication Date	Feb. 17, 2016, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
2	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
3	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
4	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
5	https://cs.cybozu.co.jp/2015/006077.html	Vendor Advisory
6	https://cs.cybozu.co.jp/2015/006077.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

CVE-2015-8486

Summary	Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2016-1152.
Publication Date	Feb. 17, 2016, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:38 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
2	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
3	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
4	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
5	https://cs.cybozu.co.jp/2015/006074.html	Vendor Advisory
6	https://cs.cybozu.co.jp/2015/006074.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

CVE-2016-1152

Summary	Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.
Publication Date	Feb. 17, 2016, 11:59 a.m.
Registration Date	Jan. 26, 2021, 2:06 p.m.
Last Update	Nov. 21, 2024, 11:45 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
2	http://jvn.jp/en/jp/JVN48720230/index.html	Vendor Advisory
3	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
4	http://jvndb.jvn.jp/jvndb/JVNDB-2016-000023	Vendor Advisory
5	https://cs.cybozu.co.jp/2015/006076.html	Vendor Advisory
6	https://cs.cybozu.co.jp/2015/006076.html	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:cybozu:office:10.0.0:::::::*
cpe:2.3:a:cybozu:office:10.3.0:::::::*
cpe:2.3:a:cybozu:office:9.9.0:::::::*
cpe:2.3:a:cybozu:office:10.1.2:::::::*
cpe:2.3:a:cybozu:office:10.1.0:::::::*
cpe:2.3:a:cybozu:office:10.0.2:::::::*
cpe:2.3:a:cybozu:office:10.0.1:::::::*
cpe:2.3:a:cybozu:office:10.2.0:::::::*