Cybozu Garoon Cross-Site Scripting Vulnerability in Message Function Allowing Password Resets

A cross-site scripting vulnerability has been identified in the Message function of Cybozu Garoon versions 5.15.0 to 6.0.3. This vulnerability could allow an attacker to execute arbitrary scripts in the context of the user's web browser, potentially leading to unauthorized password resets for users.

Impact

Exploitation of this vulnerability could result in cross-site scripting, allowing for the execution of malicious scripts in the context of the user's session. This could be used to reset passwords for arbitrary users.

Remediation

Users are advised to update to Cybozu Garoon version 6.17.0, where this vulnerability has been addressed.