CVE-2024-31404

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-31404
Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the product to view the data of Scheduler.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cs.cybozu.co.jp/2024/007901.html Vendor Advisory
https://jvn.jp/en/jp/JVN28869536/ Third Party Advisory
https://cs.cybozu.co.jp/2024/007901.html Vendor Advisory
https://jvn.jp/en/jp/JVN28869536/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cybozu:garoon:*:*:*:*:*:*:*:*
History

28 May 2025, 20:09

Type Values Removed Values Added
First Time Cybozu
Cybozu garoon
CPE cpe:2.3:a:cybozu:garoon:*:*:*:*:*:*:*:*
References () https://cs.cybozu.co.jp/2024/007901.html - () https://cs.cybozu.co.jp/2024/007901.html - Vendor Advisory
References () https://jvn.jp/en/jp/JVN28869536/ - () https://jvn.jp/en/jp/JVN28869536/ - Third Party Advisory
Information

Published : 2024-06-11 05:15

Updated : 2025-05-28 20:09

NVD link : CVE-2024-31404

Mitre link : CVE-2024-31404

CVE.ORG link : CVE-2024-31404

JSON object : View

Products Affected

cybozu

  • garoon
CWE
CWE-922

Insecure Storage of Sensitive Information