CVE-2019-5942

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to obtain files without access privileges via the Multiple Files Download function of application 'Cabinet'.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Cybozu, Inc.	Cybozu Garoon	4.0.0 to 4.10.1

References

http://jvn.jp/en/jp/JVN58849431/index.htmlThird Party Advisory
https://kb.cybozu.support/article/35485/Vendor Advisory
http://jvn.jp/en/jp/JVN58849431/index.htmlThird Party Advisory
https://kb.cybozu.support/article/35485/Vendor Advisory

Timeline

Published: May 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-59434.3Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction to view the information without view privil CVE-2019-59444.3Cybozu Garoon 4.0.0 to 4.10.1 allows remote authenticated attackers to bypass access restriction alter the contents of application 'Address'CVE-2019-59459.8Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon.CVE-2019-59466.1Open redirect vulnerability in Cybozu Garoon 4.2.4 to 4.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct ph CVE-2019-59475.4Cross-site scripting vulnerability in Cybozu Garoon 4.6.0 to 4.10.1 allows remote authenticated attackers to inject arbitrary web script or CVE-2019-59539.8Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code v CVE-2019-59549.1JR East Japan train operation information push notification App for Android version 1.2.4 and earlier allows remote attackers to bypass acce CVE-2019-59555.4CREATE SD official App for Android version 1.0.2 and earlier allows remote attackers to bypass access restriction to lead a user to access a CVE-2019-59566.5Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.CVE-2019-59577.8Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 an CVE-2019-59587.8Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier al CVE-2019-59608.8Cross-site request forgery (CSRF) vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of a