CVE-2016-1150

moderate-risk
Published 2016-02-17

Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.

Do I need to act?

-
0.52% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (15)

Affected Vendors

Cybozu

References (12)

Vendor Advisory http://jvn.jp/en/jp/JVN69278491/index.html
Vendor Advisory http://jvndb.jvn.jp/jvndb/JVNDB-2016-000026
Vendor Advisory https://cs.cybozu.co.jp/2015/006072.html
Vendor Advisory https://cs.cybozu.co.jp/2015/006087.html
Vendor Advisory https://cs.cybozu.co.jp/2016/006107.html
Vendor Advisory https://cs.cybozu.co.jp/2016/006109.html
Vendor Advisory http://jvn.jp/en/jp/JVN69278491/index.html
Vendor Advisory http://jvndb.jvn.jp/jvndb/JVNDB-2016-000026
Vendor Advisory https://cs.cybozu.co.jp/2015/006072.html
Vendor Advisory https://cs.cybozu.co.jp/2015/006087.html
Vendor Advisory https://cs.cybozu.co.jp/2016/006107.html
Vendor Advisory https://cs.cybozu.co.jp/2016/006109.html
43
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 2/34 · Minimal
Exposure 18/34 · Moderate