Multiple directory traversal vulnerabilities in (1) apps/files_trashbin/index.php via the “dir” GET parameter and (2) lib/files/view.php via undefined vectors in all ownCloud versions prior to 5.0.6 and other versions before 4.0.15, allow authenticated remote attackers to get access to arbitrary local files.
For more information please consult the official advisory.
This advisory is licensed CC BY-SA 4.0
CPE | Name | Operator | Version |
---|---|---|---|
owncloud server | lt | 4.0.15 | |
owncloud server | lt | 5.0.6 | |
owncloud server | lt | 4.5.11 |