CVE-2013-6904: Cross-site scripting (XSS) vulnerability in a note component in Cybozu Garoon before 3.7.0, when Internet E...

Security readout for executives and security teams

CVE-2013-6904 is a cross-site scripting issue in the note component of Cybozu Garoon before version 3.7.0. If exploited, an attacker could cause script or HTML to run in a user’s browser session, potentially affecting account integrity or exposed page data. The public bundle does not show active exploitation. Exposure is most likely in organizations still running Cybozu Garoon versions earlier than 3.7.0, especially where users access the note component with Internet Explorer or Firefox. Internet exposure, authentication requirements, and attacker privileges are not specified in the provided sources. Prioritize remediation if Garoon remains in production below version 3.7.0. Business urgency is moderate because XSS can affect user sessions, but public evidence here is limited and active exploitation is not confirmed. Mitigation focus: Upgrade Cybozu Garoon to version 3.7.0 or later per vendor guidance.; Review Cybozu advisory material for any version-specific instructions.; Restrict access to affected Garoon instances until patched..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.