Session Fixation - ownCloud

Due to authenticating a user without invalidating any existing session identifier an attacker has the opportunity to steal authenticated sessions. A successful exploit requires that PHP is configured to accept session parameters via GET.

Affected Software

• ownCloud Server < 6.0.2 (CVE-2014-2047)

Action Taken

The session is now regenerated after a successful login.

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

• Lukas Reschke - ownCloud Inc. ([email protected]) - Vulnerability discovery and disclosure.