CVE-2014-0817

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 does not properly manage sessions, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors.

Metrics

CVSS 2.0 4.9/10AV:N/AC:M/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cs.cybozu.co.jp/information/gr20140225up03.phpVendor Advisory
http://jvn.jp/en/jp/JVN24035499/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021
https://support.cybozu.com/ja-jp/article/7992Patch, Vendor Advisory
http://cs.cybozu.co.jp/information/gr20140225up03.phpVendor Advisory
http://jvn.jp/en/jp/JVN24035499/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000021
https://support.cybozu.com/ja-jp/article/7992Patch, Vendor Advisory

Timeline

Published: Feb 27, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-08187.5Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges and execute arbitrary VBScript cod CVE-2014-08194.4Untrusted search path vulnerability in Autodesk AutoCAD before 2014 allows local users to gain privileges via a Trojan horse DLL in the curr CVE-2014-08204.0Directory traversal vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authentic CVE-2014-08216.5SQL injection vulnerability in the download feature in Cybozu Garoon 2.x through 2.5.4 and 3.x through 3.7 SP3 allows remote authenticated u CVE-2014-08227.8The IMAP server in IBM Domino 8.5.x before 8.5.3 FP6 IF1 and 9.0.x before 9.0.1 FP1 allows remote attackers to cause a denial of service (da CVE-2014-08234.3IBM WebSphere Application Server (WAS) 8.x before 8.0.0.9 and 8.5.x before 8.5.5.2 allows remote attackers to read arbitrary files via a cra CVE-2014-08243.5Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.x before 7.1.1.8 LAFIX.20140319-0839 and 7.1.1.12 before IFIX.2014 CVE-2014-08253.5Cross-site scripting (XSS) vulnerability in openreport.jsp in IBM Maximo Asset Management 7.x before 7.1.1.12 IFIX.20140321-1336 and 7.5.x b CVE-2014-08274.3Cross-site scripting (XSS) vulnerability in IBM InfoSphere Optim Workload Replay 1.1 allows remote attackers to inject arbitrary web script CVE-2014-08284.3Cross-site scripting (XSS) vulnerability in the WCM (Web Content Manager) UI in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x t CVE-2014-08296.5Multiple buffer overflows in IBM Rational ClearCase 7.x before 7.1.2.13, 8.0.0.x before 8.0.0.10, and 8.0.1.x before 8.0.1.3 allow remote au CVE-2014-08304.0Directory traversal vulnerability in the table-export implementation in the OAC component in IBM Financial Transaction Manager (FTM) 2.0 bef