CVE-2017-2255 - Vulnerability Details

Vendors	Products
Cybozu	Garoon

Link	Providers
https://jvn.jp/en/jp/JVN63564682/index.html
https://support.cybozu.com/ja-jp/article/9746

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Cybozu Garoon", "vendor": "Cybozu, Inc.", "versions": [{"status": "affected", "version": "3.7.0 to 4.2.5"}]}], "datePublic": "2017-08-28T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via \"Rich text\" function of the application \"Space\"."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-29T14:57:02", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://support.cybozu.com/ja-jp/article/9746"}, {"name": "JVN#63564682", "tags": ["third-party-advisory", "x_refsource_JVN"], "url": "https://jvn.jp/en/jp/JVN63564682/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2017-2255", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Cybozu Garoon", "version": {"version_data": [{"version_value": "3.7.0 to 4.2.5"}]}}]}, "vendor_name": "Cybozu, Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via \"Rich text\" function of the application \"Space\"."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-site scripting"}]}]}, "references": {"reference_data": [{"name": "https://support.cybozu.com/ja-jp/article/9746", "refsource": "CONFIRM", "url": "https://support.cybozu.com/ja-jp/article/9746"}, {"name": "JVN#63564682", "refsource": "JVN", "url": "https://jvn.jp/en/jp/JVN63564682/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T13:48:04.391Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.cybozu.com/ja-jp/article/9746"}, {"name": "JVN#63564682", "tags": ["third-party-advisory", "x_refsource_JVN", "x_transferred"], "url": "https://jvn.jp/en/jp/JVN63564682/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2017-2255", "datePublished": "2017-08-28T20:00:00", "dateReserved": "2016-12-01T00:00:00", "dateUpdated": "2024-08-05T13:48:04.391Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Cybozu Garoon (string)

vendor : Cybozu, Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.7.0 to 4.2.5 (string)

}

]

}

]

datePublic : 2017-08-28T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space". (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Cross-site scripting (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-08-29T14:57:02 (string)

orgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

shortName : jpcert (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://support.cybozu.com/ja-jp/article/9746 (string)

}

1 : { »

name : JVN#63564682 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVN (string)

]

url : https://jvn.jp/en/jp/JVN63564682/index.html (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : vultures@jpcert.or.jp (string)

ID : CVE-2017-2255 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Cybozu Garoon (string)

version : { »

version_data : [ »

0 : { »

version_value : 3.7.0 to 4.2.5 (string)

}

]

}

]

}

vendor_name : Cybozu, Inc. (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space". (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Cross-site scripting (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://support.cybozu.com/ja-jp/article/9746 (string)

refsource : CONFIRM (string)

url : https://support.cybozu.com/ja-jp/article/9746 (string)

}

1 : { »

name : JVN#63564682 (string)

refsource : JVN (string)

url : https://jvn.jp/en/jp/JVN63564682/index.html (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T13:48:04.391Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://support.cybozu.com/ja-jp/article/9746 (string)

}

1 : { »

name : JVN#63564682 (string)

tags : [ »

0 : third-party-advisory (string)

1 : x_refsource_JVN (string)

2 : x_transferred (string)

]

url : https://jvn.jp/en/jp/JVN63564682/index.html (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

assignerShortName : jpcert (string)

cveId : CVE-2017-2255 (string)

datePublished : 2017-08-28T20:00:00 (string)

dateReserved : 2016-12-01T00:00:00 (string)

dateUpdated : 2024-08-05T13:48:04.391Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cybozu:garoon:3.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "3B681C16-60F7-46B5-BD26-25F7DC9F5F47", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:3.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "19694FDB-184D-4C09-BD72-BB7B96F6391D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:3.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "595FBCBB-BC3F-4E18-AFBE-C95108C4CB2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:3.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "CD33E00A-5082-42F4-81F5-4647BD602D31", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:3.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "3B130F88-71DE-4FBF-B5DF-DD8173F03151", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:3.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "3F9B321F-6CDC-426B-AE62-090E067F3533", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "42A63B4B-0248-46B0-B0FB-7DBDD48DAA80", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "E4C3A49A-0C9C-4E43-B99C-2C28A12A8A09", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "3A428CA3-8FAF-4DEB-8D95-5E76098E83B6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "7A9EABAA-964A-4242-939A-378B03A1F150", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "F9487784-3EF9-4B11-A831-5F3D35BC716E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "B03D1A99-E1D3-4400-856C-62F2961E41FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "4165B99C-EE50-4151-90AF-CE1F71E86D2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "0F6C3FA5-801C-440F-A755-6BC9BB04EB4F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cybozu:garoon:4.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "E4F71558-BFBC-4D43-AAF8-7DEB7AE2F29D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via \"Rich text\" function of the application \"Space\"."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ruta de b\u00fasqueda no confiable en el instalador en Synology Cloud Station Backup anterior a la versi\u00f3n  4.2.5-4396 en Windows, permiten a los atacantes locales ejecutar c\u00f3digo arbitrario y conducir ataques de secuestro de DLL mediante un archivo de tipo caballo de Troya en las bibliotecas (1) shfolder.dll, (2) ntmarta.dll , (3) secur32.dll o (4) dwmapi.dll, en el directorio de trabajo actual."}], "id": "CVE-2017-2255", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-29T01:35:13.627", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://jvn.jp/en/jp/JVN63564682/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://support.cybozu.com/ja-jp/article/9746"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://jvn.jp/en/jp/JVN63564682/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.cybozu.com/ja-jp/article/9746"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B681C16-60F7-46B5-BD26-25F7DC9F5F47 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 19694FDB-184D-4C09-BD72-BB7B96F6391D (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 595FBCBB-BC3F-4E18-AFBE-C95108C4CB2F (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.3:*:*:*:*:*:*:* (string)

matchCriteriaId : CD33E00A-5082-42F4-81F5-4647BD602D31 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 3B130F88-71DE-4FBF-B5DF-DD8173F03151 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:cybozu:garoon:3.7.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 3F9B321F-6CDC-426B-AE62-090E067F3533 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 42A63B4B-0248-46B0-B0FB-7DBDD48DAA80 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.0.2:*:*:*:*:*:*:* (string)

matchCriteriaId : E4C3A49A-0C9C-4E43-B99C-2C28A12A8A09 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.0.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 3A428CA3-8FAF-4DEB-8D95-5E76098E83B6 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 7A9EABAA-964A-4242-939A-378B03A1F150 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.1:*:*:*:*:*:*:* (string)

matchCriteriaId : F9487784-3EF9-4B11-A831-5F3D35BC716E (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.2:*:*:*:*:*:*:* (string)

matchCriteriaId : B03D1A99-E1D3-4400-856C-62F2961E41FE (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 4165B99C-EE50-4151-90AF-CE1F71E86D2A (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 0F6C3FA5-801C-440F-A755-6BC9BB04EB4F (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:cybozu:garoon:4.2.5:*:*:*:*:*:*:* (string)

matchCriteriaId : E4F71558-BFBC-4D43-AAF8-7DEB7AE2F29D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting vulnerability in Cybozu Garoon 3.7.0 to 4.2.5 allows an attacker to inject arbitrary web script or HTML via "Rich text" function of the application "Space". (string)

}

1 : { »

lang : es (string)

value : Múltiples vulnerabilidades de ruta de búsqueda no confiable en el instalador en Synology Cloud Station Backup anterior a la versión 4.2.5-4396 en Windows, permiten a los atacantes locales ejecutar código arbitrario y conducir ataques de secuestro de DLL mediante un archivo de tipo caballo de Troya en las bibliotecas (1) shfolder.dll, (2) ntmarta.dll , (3) secur32.dll o (4) dwmapi.dll, en el directorio de trabajo actual. (string)

}

]

id : CVE-2017-2255 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:S/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 6.8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 2.3 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-08-29T01:35:13.627 (string)

references : [ »

0 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : https://jvn.jp/en/jp/JVN63564682/index.html (string)

}

1 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.cybozu.com/ja-jp/article/9746 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : https://jvn.jp/en/jp/JVN63564682/index.html (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.cybozu.com/ja-jp/article/9746 (string)

}

]

sourceIdentifier : vultures@jpcert.or.jp (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object