{"id": "OPENVAS:1361412562310804663", "type": "openvas", "bulletinFamily": "scanner", "title": "ownCloud Preview Picture Access Authentication Bypass Vulnerability", "description": "This host is installed with ownCloud and is prone to unauthorized picture\npreview access.", "published": "2014-07-03T00:00:00", "modified": "2020-04-20T00:00:00", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310804663", "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "references": ["http://owncloud.org/security/advisory/?id=oC-SA-2014-009", "http://www.zerodaylab.com/vulnerabilities/CVE-2014/CVE-2014-3963.html"], "cvelist": ["CVE-2014-3963"], "lastseen": "2020-04-22T17:03:36", "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-3963"]}], "modified": "2020-04-22T17:03:36", "rev": 2}, "score": {"value": 5.6, "vector": "NONE", "modified": "2020-04-22T17:03:36", "rev": 2}, "vulnersScore": 5.6}, "pluginID": "1361412562310804663", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# ownCloud Preview Picture Access Authentication Bypass Vulnerability\n#\n# Authors:\n# Shakeel <bshakeel@secpod.com>\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:owncloud:owncloud\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.804663\");\n script_version(\"2020-04-20T13:31:49+0000\");\n script_cve_id(\"CVE-2014-3963\");\n script_bugtraq_id(68194);\n script_tag(name:\"cvss_base\", value:\"4.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-04-20 13:31:49 +0000 (Mon, 20 Apr 2020)\");\n script_tag(name:\"creation_date\", value:\"2014-07-03 16:32:28 +0530 (Thu, 03 Jul 2014)\");\n script_name(\"ownCloud Preview Picture Access Authentication Bypass Vulnerability\");\n\n\n script_tag(name:\"summary\", value:\"This host is installed with ownCloud and is prone to unauthorized picture\npreview access.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The flaw is due to the server failing to sufficiently check if an\nauthenticated user has access to preview pictures of other users\");\n script_tag(name:\"impact\", value:\"Successful exploitation will allow remote attackers to view other user's\npictures.\");\n script_tag(name:\"affected\", value:\"ownCloud Server 6.0.x before 6.0.1\");\n script_tag(name:\"solution\", value:\"Upgrade to ownCloud version 6.0.1 or later.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name:\"URL\", value:\"http://owncloud.org/security/advisory/?id=oC-SA-2014-009\");\n script_xref(name:\"URL\", value:\"http://www.zerodaylab.com/vulnerabilities/CVE-2014/CVE-2014-3963.html\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_owncloud_detect.nasl\");\n script_mandatory_keys(\"owncloud/installed\");\n script_require_ports(\"Services/www\", 80);\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif(!ownPort = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!ownVer = get_app_version(cpe:CPE, port:ownPort)){\n exit(0);\n}\n\nif(version_is_equal(version:ownVer, test_version:\"6.0.0\"))\n{\n report = report_fixed_ver(installed_version:ownVer, vulnerable_range:\"Equal to 6.0.0\");\n security_message(port:ownPort, data:report);\n exit(0);\n}\n", "naslFamily": "Web application abuses"}

{"cve": [{"lastseen": "2020-12-09T19:58:24", "description": "ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors.", "edition": 5, "cvss3": {}, "published": "2014-06-04T14:55:00", "title": "CVE-2014-3963", "type": "cve", "cwe": ["CWE-264"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2014-3963"], "modified": "2014-06-05T17:35:00", "cpe": ["cpe:/a:owncloud:owncloud:6.0.0"], "id": "CVE-2014-3963", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3963", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:owncloud:owncloud:6.0.0:*:*:*:*:*:*:*"]}]}