CVE-2015-5649

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privileges.

Metrics

CVSS 2.0 7.0/10AV:N/AC:M/Au:S/C:C/I:P/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN38369032/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152Vendor Advisory
https://support.cybozu.com/ja-jp/article/9176Vendor Advisory
http://jvn.jp/en/jp/JVN38369032/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000152Vendor Advisory
https://support.cybozu.com/ja-jp/article/9176Vendor Advisory

Timeline

Published: Oct 8, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-56505.0Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.CVE-2015-56514.3Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspeci CVE-2015-56527.2Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan hors CVE-2015-56537.5Buffer overflow in Canary Labs Trend Web Server before 9.5.2 allows remote attackers to execute arbitrary code via a crafted TCP packet.CVE-2015-56544.3Cross-site scripting (XSS) vulnerability in Dojo Toolkit before 1.2 allows remote attackers to inject arbitrary web script or HTML via unspe CVE-2015-56555.8The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacker CVE-2015-56596.5SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users CVE-2015-56606.8Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary CVE-2015-56614.3The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive i CVE-2015-56626.4Directory traversal vulnerability in Avast before 150918-0 allows remote attackers to delete or write to arbitrary files via a crafted entry CVE-2015-56637.4The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name simi CVE-2015-56646.1Cross-site scripting (XSS) vulnerability in File Station in QNAP QTS before 4.2.0 allows remote attackers to inject arbitrary web script or