CVE-2011-1333

Vulnerability

Cross-site scripting (XSS) vulnerability exists in Cybozu Office 6 and Cybozu Garoon versions 2.0.0 through 2.1.3. The flaw occurs due to insufficient input sanitization when downloading graphic files from the bulletin board system [1][2].

Exploitation

An attacker can exploit this vulnerability by posting a crafted graphic file to the bulletin board. A victim user must be logged in and download the malicious file, triggering the XSS. No special network position is required beyond access to the bulletin board [1][2].

Impact

Successful exploitation allows arbitrary script execution in the victim's browser within the context of the affected application. This can lead to session hijacking, credential theft, or other malicious actions [1][2].

Mitigation

Update to the latest version provided by Cybozu. Specific fixed versions are not disclosed in the available references, but users should apply the vendor's patch [1][2].