Login Request a demo
Unscored severity · published Aug 31, 2006
CVE-2006-4490
Multiple directory traversal vulnerabilities in Cybozu Office before 6.6 Build 1.3 and Share 360 before 2.5 Build 0.3 allow remote authenticated users to read arbitrary files via…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in Cybozu Office before 6.6 Build 1.3 and Share 360 before 2.5 Build 0.3 allow remote authenticated users to read arbitrary files via a .. (dot dot) sequence via the id parameter in (1) scripts/cbag/ag.exe or (2) scripts/s360v2/s360.exe.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Cybozu Office · Cybozu
through 6.6_build_1.2 · source: NVD
S3
Share 360 · Cybozu
through 2.5_build_0.2 · source: NVD
Affected product
CO
Cybozu Office
Cybozu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4490
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4490
cybozu.co.jp
http://cybozu.co.jp/products/dl/notice_060825/
jvn.jp
http://jvn.jp/jp/JVN%2390420168/index.html
Vendor Advisory
http://secunia.com/advisories/21618
Vendor Advisory
http://secunia.com/advisories/21623
securitytracker.com
http://securitytracker.com/id?1016759
vuln.sg
http://vuln.sg/cybozu-en.html
More from Cybozu Office
–
CVE-2013-3656
Cybozu Office 9.1.0 and earlier does not properly manage sessions, which allows remote attackers to bypass authentication by leveraging knowledge of a login URL
–
CVE-2013-3269
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0 allows remote attackers to hijack the authentication of arbitrary users for…
–
CVE-2013-2305
Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Mailwise before 5.0.4 allows remote…
–
CVE-2010-2029
Cybozu Office 7 Ktai and Dotsales do not properly restrict access to the login page, which allows remote attackers to bypass authentication and obtain or modify sensitive…
–
CVE-2008-6744
Cross-site request forgery (CSRF) vulnerability in Cybozu Office 6, Cybozu Dezie before 6.0(1.0), and Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack the…