Information disclosure in Cybozu Mailwise

CVE-2013-4698

Cybozu Mailwise 5.0.4 and 5.0.5 allows remote authenticated users to obtain sensitive e-mail content intended for different persons in opportunistic circumstances by reading Subject header lines within the user's own mailbox.

Vulnerability class: Information Disclosure

EPSS: 0.010 (58.3th percentile) — read the EPSS interpretation.

Affected products

Cybozu Mailwise — versions 5.0.4, 5.0.5
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_CONFIRM, Vendor Advisory)
vultures@jpcert.or.jp (x_refsource_CONFIRM)
vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)