Due to not properly sanitizing the LDAP queries an attacker is able to:
- Gain information about existing LDAP users
- Modify the login query, e.g. with a wildcard
Affected Software
- ownCloud Server < 6.0.2 (CVE-2014-2047)
- ownCloud Server < 5.0.15 (CVE-2014-2049)
Action Taken
All LDAP queries have been reviewed and proper sanitization added.
Acknowledgements
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Lukas Reschke - ownCloud Inc. ([email protected]) - Vulnerability discovery and disclosure.