CVE-2021-20803

Vulnerability

An operation restriction bypass vulnerability exists in the management screen of Cybozu Remote Service versions 3.1.8 to 3.1.9. A remote authenticated attacker can exploit this flaw to alter data on the management screen. The vulnerability is classified under authorization, permissions, and access control issues [1][2].

Exploitation

An attacker needs valid credentials to authenticate to the Cybozu Remote Service. No user interaction is required, and the attack complexity is low. The attacker can then send crafted requests to the management screen to bypass intended operation restrictions and modify data [2].

Impact

Successful exploitation allows the attacker to tamper with data on the management screen, affecting data integrity. The CVSS v3 base score is 5.4 (Medium), with low impact on integrity and availability, and no impact on confidentiality [2]. The scope remains unchanged, meaning the compromise is limited to the vulnerable component [2].

Mitigation

The issue is fixed in Cybozu Remote Service version 4.0.0, released on 2021-09-29 [2]. Users should update to the latest version. No workarounds are described in the available references