Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions, and execute arbitrary code or cause a denial of service, via an API call.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Garoon | Cybozu | 3.7-sp1 (including) | 3.7-sp1 (including) |
| Garoon | Cybozu | 3.7-sp2 (including) | 3.7-sp2 (including) |
| Garoon | Cybozu | 3.7-sp3 (including) | 3.7-sp3 (including) |
| Garoon | Cybozu | 3.7.0 (including) | 3.7.0 (including) |