CVE-2013-0304

2014-06-0515:44:07

CWE-264

[email protected]

web.nvd.nist.gov

cve-2013-0304

owncloud server

calendar

export

csrf

vulnerability

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.7%

JSON

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

Affected configurations

NVD

Node

owncloudowncloudRange≤4.5.6

owncloudowncloudMatch4.5.0

owncloudowncloudMatch4.5.1

owncloudowncloudMatch4.5.2

owncloudowncloudMatch4.5.3

owncloudowncloudMatch4.5.4

owncloudowncloudMatch4.5.5

CPENameOperatorVersion
owncloud:owncloudowncloudle4.5.6
owncloud:owncloudowncloudeq4.5.0
owncloud:owncloudowncloudeq4.5.1
owncloud:owncloudowncloudeq4.5.2
owncloud:owncloudowncloudeq4.5.3
owncloud:owncloudowncloudeq4.5.4
owncloud:owncloudowncloudeq4.5.5

CPE	Name	Operator	Version
owncloud:owncloud	owncloud	le	4.5.6
owncloud:owncloud	owncloud	eq	4.5.0
owncloud:owncloud	owncloud	eq	4.5.1
owncloud:owncloud	owncloud	eq	4.5.2
owncloud:owncloud	owncloud	eq	4.5.3
owncloud:owncloud	owncloud	eq	4.5.4
owncloud:owncloud	owncloud	eq	4.5.5