CVE-2015-8487

Vulnerability

Cybozu Office versions 9.0.0 through 10.3 contain an information disclosure vulnerability that allows remote attackers to discover cross-site request forgery (CSRF) protection tokens via unspecified vectors [1][2][3]. This vulnerability is distinct from CVE-2015-8488 [1][2].

Exploitation

An attacker must trick a logged-in user into viewing a specially crafted page [1][2]. No authentication or network position beyond standard web access is required [2]. When the user visits the malicious page, the CSRF token is disclosed to the attacker [1][2].

Impact

Successful exploitation results in the disclosure of the CSRF token [1][2]. With the token, the attacker can perform further attacks such as forging requests on behalf of the victim, potentially leading to unauthorized actions [1][2]. The confidentiality impact is low; integrity and availability are not directly affected [2].

Mitigation

For on-premises installations, the vulnerability is fixed in Cybozu Office version 10.4.0 [3]. For Cybozu Office on cybozu.com, the fix was applied during maintenance in October 2015 [3]. Users should update to the latest version as recommended by the vendor [1][2][3].