CVE-2016-4867

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN07148816/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000187.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/93461Third Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9429Vendor Advisory
http://jvn.jp/en/jp/JVN07148816/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000187.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/93461Third Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9429Vendor Advisory

Timeline

Published: Apr 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48684.3Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unin CVE-2016-48696.5Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.CVE-2016-48705.4Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or CVE-2016-48716.5Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.CVE-2016-48724.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects CVE-2016-48734.3Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.CVE-2016-48743.5Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.CVE-2016-48756.1Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.CVE-2016-48768.8Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication CVE-2016-48775.4Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitr CVE-2016-48788.8Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication CVE-2016-48798.8Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the aut