Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-4869: Cybozu Office can leak session data to attackers

CVE-2016-4869 · published 9 years ago

Summary

Versions 9.0.0 through 10.4.0 of Cybozu Office expose internal session information on a web page that shows server variables. An attacker who can reach that page can see users' session details and potentially hijack their accounts. Update to a patched version or apply the vendor's recommended configuration to block access to the page.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cybozu	office	9.0 9.1.0 9.2.0 9.2.1 9.3.0 9.3.1 9.3.2 9.9.0 10.0.0 10.0.1 10.0.2 10.1.0 4 more version ranges `cpe:2.3:a:cybozu:office:9.0:::::::*`

Original advisory text

Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.

References

http://jvn.jp/en/jp/JVN09736331/index.html Third Party Advisory VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000191.html Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/97715 Third Party Advisory VDB Entry
https://support.cybozu.com/ja-jp/article/9428 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published17 Apr 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-4869 · NVD

Track software like this

Free during beta