CVE-2013-6901: Cross-site scripting (XSS) vulnerability in the Space function in Cybozu Garoon before 3.7.0, when Firefox...

Security readout for executives and security teams

CVE-2013-6901 is a browser-specific cross-site scripting issue in Cybozu Garoon’s Space function before version 3.7.0. A remote attacker could inject web script or HTML when Firefox is used. The sources do not provide a CVSS score, detailed vector, or evidence of active exploitation. Exposure is most likely limited to organizations still running Cybozu Garoon before 3.7.0, especially where users access the Space function with Firefox. Internet-facing or partner-accessible Garoon deployments would have higher practical concern. Treat this as a targeted legacy application risk, not a current emergency based on the provided evidence. Prioritize remediation if Garoon is internet-facing, handles sensitive collaboration data, or remains below 3.7.0. Mitigation focus: Confirm whether Cybozu Garoon is deployed and identify the exact version.; Update Garoon versions before 3.7.0 according to Cybozu guidance.; Restrict access to legacy Garoon instances until remediation is complete..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.