CVE-2018-0533

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Cybozu Garoon 3.0.0 to 4.2.6 allows remote authenticated attackers to bypass access restriction to alter setting data of session authentication via unspecified vectors.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Cybozu, Inc.	Cybozu Garoon	3.0.0 to 4.2.6

References

http://jvn.jp/en/jp/JVN65268217/index.htmlThird Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9375Vendor Advisory
http://jvn.jp/en/jp/JVN65268217/index.htmlThird Party Advisory, VDB Entry
https://support.cybozu.com/ja-jp/article/9375Vendor Advisory

Timeline

Published: Apr 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-05346.1Cross-site scripting vulnerability in ArsenoL Version 0.5 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-05356.1Cross-site scripting vulnerability in PHP 2chBBS version bbs18c allows an attacker to inject arbitrary web script or HTML via unspecified ve CVE-2018-05366.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz.cgi.CVE-2018-05376.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via quiz_op.cgi.CVE-2018-05386.1Cross-site scripting vulnerability in QQQ SYSTEMS ver2.24 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-05399.8QQQ SYSTEMS version 2.24 allows an attacker to execute arbitrary commands via unspecified vectors.CVE-2018-05407.8Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified CVE-2018-05419.8Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service (DoS) condition or execute arbitrary code via un CVE-2018-05427.5Directory traversal vulnerability in WebProxy version 1.7.8 allows an attacker to read arbitrary files via unspecified vectors.CVE-2018-05437.8Untrusted search path vulnerability in Jtrim 1.53c and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in a CVE-2018-05447.8Untrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker to gain privileges via a Trojan horse DLL in CVE-2018-05459.8LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.