CVE-2016-4843: Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information

Medium severity · published Apr 20, 2017

CVE-2016-4843

Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information

6.5

CVSS

1.9%

EPSS

On KEV

Description

Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.9% · higher than 80% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Mailwise · Cybozu

5.0.0; 5.0.1; 5.0.4; 5.0.5; 5.0.6; 5.1.0; +8 more · source: NVD

Affected product

Mailwise

Cybozu

All Mailwise CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-4843

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-4843

Third Party Advisory

http://jvn.jp/en/jp/JVN03052683/index.html

VDB Entry

http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000137.html

Third Party Advisory

http://www.securityfocus.com/bid/92461

Vendor Advisory

https://support.cybozu.com/ja-jp/article/9654