CRITICAL🇵🇱 Wersja polska

CVE-2024-31401

CVSS 9.0v3.1pub. 2024-06-11upd. 2025-08-05

Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the user who is logging in to the product.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

  • Cybozu Garoon

    APP
    Cybozu
    5.5.0 – 6.0.0 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2019-5945CRITICAL9.8ten sam produkt

Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authe...

CVE-2016-1219CRITICAL9.8ten sam produkt

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API u...

CVE-2022-30602HIGH8.1ten sam produkt

Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenti...

CVE-2022-29484HIGH8.1ten sam produkt

Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authentica...

CVE-2021-20758HIGH8.0ten sam produkt

Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote aut...