CVE-2021-20804

Vulnerability

A denial-of-service (DoS) vulnerability exists in Cybozu Remote Service versions 3.1.8 to 3.1.9. The issue is classified as improper input validation (CWE-20) in unspecified functionality. An authenticated attacker can trigger this condition, leading to high system resource load and service disruption [1], [2].

Exploitation

An attacker must have low-level authenticated access to the Cybozu Remote Service (network access, low complexity, no user interaction required). The exact exploitation steps are not publicly disclosed to prevent attacks, but the vulnerability can be exploited remotely by sending crafted input to the affected service [1], [2].

Impact

Successful exploitation leads to a denial-of-service condition where system resources are exhausted, making the service unavailable. The availability impact is rated as high, while confidentiality and integrity remain unaffected [1], [2].

Mitigation

The vulnerability is fixed in Cybozu Remote Service version 4.0.0, released on 2021-09-29 [2]. No workarounds are provided for earlier versions (3.1.8 and 3.1.9), and support for those versions has ended [2].