Lucene search

[email protected]NVD:CVE-2012-5606

HistoryDec 18, 2012 - 1:55 a.m.

CVE-2012-5606

2012-12-1801:55:07

CWE-79

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js.

Affected configurations

NVD

Node

owncloudowncloudRange≤4.0.8

owncloudowncloudMatch3.0.0

owncloudowncloudMatch3.0.1

owncloudowncloudMatch3.0.2

owncloudowncloudMatch3.0.3

owncloudowncloudMatch4.0.0

owncloudowncloudMatch4.0.1

owncloudowncloudMatch4.0.2

owncloudowncloudMatch4.0.3

owncloudowncloudMatch4.0.4

owncloudowncloudMatch4.0.5

owncloudowncloudMatch4.0.6

owncloudowncloudMatch4.0.7

owncloudowncloudMatch4.5.0

References

owncloud.org/changelog/

owncloud.org/security/advisories/oc-sa-2012-001/

secunia.com/advisories/51357

www.openwall.com/lists/oss-security/2012/11/30/3

github.com/owncloud/core/commit/ce66759

github.com/owncloud/core/commit/e45f36c

github.com/owncloud/core/commit/e5f2d46

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

Related for NVD:CVE-2012-5606

ubuntucve1 prion1 cve1 cvelist1 openvas1