CVE-2015-8488

Vulnerability

Cybozu Office 10.3.0 contains an information disclosure vulnerability in its mail function [1][2]. When a specially crafted e-mail message is opened, the application improperly processes embedded image requests, allowing an attacker to read image files [1]. The vulnerability is distinct from CVE-2015-8487 [1]. Affected versions: Cybozu Office 10.3.0 [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted e-mail message to an authenticated user of Cybozu Office [1][2]. The attack requires no privileges but does require user interaction — the recipient must open the crafted email [3]. The attack vector is network-based with low complexity [2].

Impact

When a specially crafted mail is opened, image files accessible by authenticated users may be obtained by a third-party [1][2]. The confidentiality impact is low; there is no integrity or availability impact [2]. The CVSS v3 base score is 4.3 (Medium) [2].

Mitigation

Users should update to Cybozu Office version 10.4.0 or later, which contains the fix [3]. For Cybozu Office on cybozu.com, the fix was applied in the October 2015 maintenance update [3]. Customers with a valid service license can upgrade for free [3].