CVE-2011-1335

Vulnerability

Cybozu Office versions 6, 7, and prior to 8.1.1 contain a cross-site scripting (XSS) vulnerability in the address book and user list functions [1][2]. The vulnerability allows remote attackers to inject arbitrary web script or HTML via vectors related to these functions [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious link or input that, when accessed by a logged-in user, injects and executes arbitrary script in the user's browser. The CVSS v2 score indicates an access vector of Network, low complexity, and single authentication requirement, meaning the attacker does not need to be authenticated but the victim must have an active session [2]. The user interaction is required for the attack to succeed.

Impact

Successful exploitation allows the attacker to execute arbitrary script in the context of the victim's browser session on the Cybozu Office application. This can lead to session hijacking, defacement, or theft of sensitive information displayed or accessible through the application [1][2].

Mitigation

Cybozu has released version 8.1.1 which addresses this vulnerability [1][2]. Users should update to the latest version as provided by the vendor. No workarounds are documented in the available references.