CVE-2014-3837

2014-06-0414:55:04

CWE-264

mitre

web.nvd.nist.gov

owncloud

server

6.0.3

remote authenticated users

enumerate

shared files

cve-2014-3837

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

36.5%

JSON

The document application in ownCloud Server before 6.0.3 uses sequential values for the file_id, which allows remote authenticated users to enumerate shared files via unspecified vectors.

Affected configurations

Nvd

Node

owncloudowncloudRange≤6.0.2

owncloudowncloudMatch6.0.0

owncloudowncloudMatch6.0.1

VendorProductVersionCPE
owncloudowncloud*cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
owncloudowncloud6.0.0cpe:2.3:a:owncloud:owncloud:6.0.0:*:*:*:*:*:*:*
owncloudowncloud6.0.1cpe:2.3:a:owncloud:owncloud:6.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
owncloud	owncloud	*	cpe:2.3:a:owncloud:owncloud::::::::
owncloud	owncloud	6.0.0	cpe:2.3:a:owncloud:owncloud:6.0.0:::::::*
owncloud	owncloud	6.0.1	cpe:2.3:a:owncloud:owncloud:6.0.1:::::::*