Lucene search
Emanuel Bronshtein – Vulnerability discovery and disclosure., Nico Golde – Vulnerability discovery and disclosure.OWNCLOUD:884AC57C3DAF217F9BB463135C45A5B8HistoryAug 10, 2012 - 5:05 p.m.
Multiple XSS vulnerabilities - ownCloud
2012-08-1017:05:36
Emanuel Bronshtein – Vulnerability discovery and disclosure., Nico Golde – Vulnerability discovery and disclosure.
owncloud.org
21
0.001 Low
EPSS
Percentile
50.2%
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.8 allow remote attackers to inject arbitrary web script or HTML via
- the readyCallback parameter to PUT.swf in apps/files_odfviewer/src/webodf/webodf/flashput/
- the root parameter to index.php in apps/gallery/templates/
- a malformed query to db.php in lib/
Affected Software
- ownCloud Server < 4.0.8 (CVE-2012-5056)
Action Taken
It is recommended that all instances are upgraded to ownCloud Server 4.0.8.
Acknowledgements
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Emanuel Bronshtein - Vulnerability discovery and disclosure.
- Nico Golde - Vulnerability discovery and disclosure.
| CPE | Name | Operator | Version |
|---|---|---|---|
| owncloud server | lt | 4.0.8 |
Related
prion
prion
Cross site scripting
2014-06-04 14:55:00
owncloud
owncloud
Server: Multiple XSS vulnerabilities
2012-08-10 11:42:22
cvelist
cvelist
CVE-2012-5056
2014-06-04 14:00:00
cve
cve
CVE-2012-5056
2014-06-04 14:55:03
ubuntucve
ubuntucve
CVE-2012-5056
2014-06-04 00:00:00
nvd
nvd
CVE-2012-5056
2014-06-04 14:55:03
openvas
openvas
ownCloud Multiple Vulnerabilities-01 (Jul 2014)
2014-07-03 00:00:00