CVE-2011-1332

Vulnerability

Cybozu Garoon versions 2.0.0 through 2.1.3 are vulnerable to a cross-site scripting (XSS) issue. The vulnerability resides in unspecified vectors within the groupware application and allows injection of arbitrary web script or HTML. [1][2]

Exploitation

An attacker can exploit this vulnerability by sending a crafted link or input to a logged-in user. The user must interact with the malicious content (e.g., by clicking a link) for the script to execute. The CVSS v2 score (2.6, Low) indicates high access complexity, suggesting that successful exploitation requires some user interaction. [1][2]

Impact

If exploited, arbitrary script may be executed in the context of the victim's browser session. This can lead to theft of session cookies, defacement, or other actions performed on behalf of the authenticated user. Confidentiality of the user's data may be partially compromised. [1][2]

Mitigation

The vendor, Cybozu, recommends updating to the latest version of Garoon. The fixed version was released prior to the public disclosure on 2011-06-24. No workarounds are documented. Users should apply the update according to vendor instructions. [1][2]