Login Request a demo
Medium severity · published Apr 17, 2017
CVE-2016-4868
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted…
4.3
CVSS
1.5%
EPSS
No
On KEV
Description
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Cybozu
9.0; 9.1.0; 9.2.0; 9.2.1; 9.3.0; 9.3.1; +10 more · source: NVD
Affected product
OF
Office
Cybozu
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4868
Third Party Advisory
http://jvn.jp/en/jp/JVN08736331/index.html
Third Party Advisory
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000190.html
Third Party Advisory
http://www.securityfocus.com/bid/97713
Vendor Advisory
https://support.cybozu.com/ja-jp/article/9433
More from Office
8.8
CVE-2016-1151
Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers to hijack the authentication of arbitrary users
7.5
CVE-2018-0704
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen
7.5
CVE-2018-0703
Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests
7.4
CVE-2015-8483
Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL
6.5
CVE-2024-39817
Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user…