CVE-2014-9044

2015-02-0418:59:04

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.1

Confidence

Low

EPSS

0.002

Percentile

56.5%

JSON

Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack.

Affected configurations

Nvd

Node

owncloudowncloudMatch7.0.0

owncloudowncloudMatch7.0.1

owncloudowncloudMatch7.0.2

VendorProductVersionCPE
owncloudowncloud7.0.0cpe:2.3:a:owncloud:owncloud:7.0.0:*:*:*:*:*:*:*
owncloudowncloud7.0.1cpe:2.3:a:owncloud:owncloud:7.0.1:*:*:*:*:*:*:*
owncloudowncloud7.0.2cpe:2.3:a:owncloud:owncloud:7.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
owncloud	owncloud	7.0.0	cpe:2.3:a:owncloud:owncloud:7.0.0:::::::*
owncloud	owncloud	7.0.1	cpe:2.3:a:owncloud:owncloud:7.0.1:::::::*
owncloud	owncloud	7.0.2	cpe:2.3:a:owncloud:owncloud:7.0.2:::::::*