ID CVE-2012-4392 Type cve Reporter NVD Modified 2012-09-13T00:00:00
Description
index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie value.
{"reporter": "NVD", "enchantments": {"vulnersScore": 6.8}, "published": "2012-09-05T19:55:02", "cvelist": ["CVE-2012-4392"], "title": "CVE-2012-4392", "objectVersion": "1.2", "type": "cve", "hash": "d169ea7dbef6523cdd973b5108fc27a7e0298e1629df3d7216f0852d99da2cd9", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4392", "bulletinFamily": "NVD", "id": "CVE-2012-4392", "history": [], "scanner": [], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "modified": "2012-09-13T00:00:00", "viewCount": 1, "cpe": ["cpe:/a:owncloud:owncloud:4.0.7"], "edition": 1, "description": "index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie value.", "references": ["http://www.openwall.com/lists/oss-security/2012/09/02/2", "http://www.openwall.com/lists/oss-security/2012/08/11/1", "https://github.com/owncloud/core/commit/4fd069b47906ebcf83887970c732d464dbe7d37a"], "lastseen": "2016-09-03T17:02:12", "assessment": {"system": "", "name": "", "href": ""}}
{"result": {"owncloud": [{"id": "OC-SA-2012-015", "type": "owncloud", "title": "Server: Auth bypass in index.php", "description": "index.php before ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie value.\n\n \n\n\n* * *\n\n**[For more information please consult the official advisory.](<https://owncloud.org/security/advisory/?id=oC-SA-2012-015>)**\n\n\nThis advisory is licensed [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)", "published": "2012-07-10T11:42:22", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://owncloud.org/security/advisory/?id=oC-SA-2012-015", "cvelist": ["CVE-2012-4392"], "lastseen": "2016-09-26T21:06:29"}, {"id": "OWNCLOUD:35476A47608569B13CE031AD08D716F1", "type": "owncloud", "title": "Auth bypass in index.php - ownCloud", "description": "index.php before ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie value.\n\n### Affected Software\n\n * ownCloud Server < **4.0.7** (CVE-2012-4392)\n\n### Action Taken\n\nIt is recommended that all instances are upgraded to ownCloud Server 4.0.7.\n\n### Acknowledgements\n\nThe ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:\n\n * Julien Cayssol - Vulnerability discovery and disclosure.\n", "published": "2012-07-10T17:18:01", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://owncloud.org/security/advisories/auth-bypass-index-php/", "cvelist": ["CVE-2012-4392"], "lastseen": "2018-01-11T22:53:27"}]}}
