MEDIUM4.0
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю обойти существующие ограничения доступа и получить доступ к файлам пользователей
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:NReferences
Severity:
Closed issues (10)
CRITICAL9.0
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю выполнить произвольные SMB-команды
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CReferences
HIGH7.8
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CReferences
MEDIUM6.8
Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PReferences
- http://advisories.mageia.org/MGASA-2014-0301.html
- http://owncloud.org/security/advisory/?id=oc-sa-2014-018
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:140
- http://www.securityfocus.com/bid/68975
- http://advisories.mageia.org/MGASA-2014-0301.html
- http://owncloud.org/security/advisory/?id=oc-sa-2014-018
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:140
- http://www.securityfocus.com/bid/68975
MEDIUM4.3
The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:NMEDIUM5.0
The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:NMEDIUM4.9
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:NCVSS 3.xMEDIUM 4.9
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NReferences
- http://www.securityfocus.com/bid/76158
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005
- http://www.securityfocus.com/bid/76158
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005
HIGH7.8
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCRITICAL9.0
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:CMEDIUM4.0
The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder.
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:P/I:N/A:N