CVE-2013-6905: Cross-site scripting (XSS) vulnerability in a phone component in Cybozu Garoon before 3.7.0, when Internet...

Security readout for executives and security teams

CVE-2013-6905 is a cross-site scripting issue in the phone component of Cybozu Garoon before 3.7.0. A remote attacker could inject script or HTML when affected users access the component with Internet Explorer or Firefox. Business urgency depends on whether old Garoon versions and those browsers remain in use. Exposure is most likely in organizations still running Cybozu Garoon versions earlier than 3.7.0, especially where users access the phone component through Internet Explorer or Firefox. Treat this as a moderate legacy application risk. It is not flagged as actively exploited in the supplied data, but older groupware platforms can expose user sessions and internal workflows if XSS remains unpatched. Mitigation focus: Confirm whether any Cybozu Garoon deployment is earlier than version 3.7.0.; Upgrade affected Garoon systems to 3.7.0 or later per vendor guidance.; Review Cybozu and JVN advisories for product-specific remediation details..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.