CVE-2013-6003: CRLF injection vulnerability in Cybozu Garoon 3.1 through 3.5 SP5, when Phone Messages forwarding is enable...

Security readout for executives and security teams

Cybozu Garoon versions 3.1 through 3.5 SP5 can mishandle Phone Messages forwarding. An authenticated remote user may inject extra email headers, potentially altering forwarded mail behavior or trust signals. The issue is conditional on that feature being enabled, and the supplied sources do not provide a CVSS score. Exposure appears limited to organizations running Cybozu Garoon 3.1 through 3.5 SP5 with Phone Messages forwarding enabled. Because exploitation requires authentication, internet exposure matters less than who can log in and use or reach the vulnerable workflow. Prioritize if Garoon is still in use and Phone Messages forwarding is enabled. The issue is old and authenticated, but it can affect email trust and downstream mail handling. If the product is retired or updated beyond the affected range, residual risk is likely low. Mitigation focus: Review Cybozu and JVN advisories for vendor-supported remediation guidance.; Identify and remediate Garoon 3.1 through 3.5 SP5 systems per Cybozu guidance.; Check whether Phone Messages forwarding is enabled on affected deployments..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.