Login Request a demo
Medium severity · published Jun 19, 2016
CVE-2015-7776
Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail…
4.3
CVSS
1.3%
EPSS
No
On KEV
Description
Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GA
Garoon · Cybozu
3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.1.0; 3.1.1; +18 more · source: NVD
Affected product
GA
Garoon
Cybozu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7776
Vendor Advisory
http://jvn.jp/en/jp/JVN53542912/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000085
Patch
https://support.cybozu.com/ja-jp/article/8757
Patch
https://support.cybozu.com/ja-jp/article/8897
Patch
https://support.cybozu.com/ja-jp/article/8951
Patch
https://support.cybozu.com/ja-jp/article/8982
More from Garoon
9.8
CVE-2019-5945
Cybozu Garoon 4.2.4 to 4.10.1 allow remote attackers to obtain the users' credential information via the authentication of Cybozu Garoon
9.8
CVE-2016-1219
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use
9.0
CVE-2024-31401
Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the…
8.8
CVE-2018-0607
SQL injection vulnerability in the Notifications application in the Cybozu Garoon 3.5.0 to 4.6.2 allows remote authenticated attackers to execute arbitrary SQL commands via…
8.8
CVE-2018-0530
SQL injection vulnerability in the Cybozu Garoon 3.5.0 to 4.2.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors