CVE-2013-6912: Cross-site scripting (XSS) vulnerability in a calendar component in Cybozu Garoon before 3.7.2, when Intern...

Security readout for executives and security teams

This is an authenticated cross-site scripting issue in the calendar component of Cybozu Garoon before 3.7.2. It matters mainly where legacy Internet Explorer 6 through 9 is used. A logged-in attacker could inject script or HTML that runs in another user's browser within Garoon. Exposure is most likely in organizations still running Cybozu Garoon versions earlier than 3.7.2, especially where users access the calendar with Internet Explorer 6, 7, 8, or 9. Treat this as a targeted cleanup item unless legacy Garoon or old Internet Explorer use remains. Prioritize remediation for environments with sensitive internal collaboration data or broad authenticated user access. Mitigation focus: Upgrade Cybozu Garoon to version 3.7.2 or later.; Review Cybozu and JVN guidance before choosing compensating controls.; Retire Internet Explorer 6 through 9 for Garoon access..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.