Lucene search
Lukas Reschke – ownCloud Inc. ([email protected]) – Vulnerability discovery and disclosure.OWNCLOUD:C0DB1512F934FC1F84990A82752DDF2DHistoryAug 10, 2012 - 5:09 p.m.
Auth bypass in /lib/base.php - ownCloud
2012-08-1017:09:56
Lukas Reschke – ownCloud Inc. ([email protected]) – Vulnerability discovery and disclosure.
owncloud.org
28
0.001 Low
EPSS
Percentile
36.7%
/lib/base.php before ownCloud 4.0.8 does not properly validate the user_id session variable via WebDAV, which allows authenticated attackers to gain access to other users files.
Affected Software
- ownCloud Server < 4.0.8 (CVE-2012-5336)
Action Taken
It is recommended that all instances are upgraded to ownCloud Server 4.0.8.
Acknowledgements
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Lukas Reschke - ownCloud Inc. ([email protected]) - Vulnerability discovery and disclosure.
| CPE | Name | Operator | Version |
|---|---|---|---|
| owncloud server | lt | 4.0.8 |
Related
ubuntucve
ubuntucve
CVE-2012-5336
2014-06-04 00:00:00
prion
prion
Open redirect
2014-06-04 14:55:00
nvd
nvd
CVE-2012-5336
2014-06-04 14:55:03
owncloud
owncloud
Server: Auth bypass in /lib/base.php
2012-08-10 11:42:22
cvelist
cvelist
CVE-2012-5336
2014-06-04 14:00:00
cve
cve
CVE-2012-5336
2014-06-04 14:55:03
openvas
openvas
ownCloud Multiple Vulnerabilities-01 (Jul 2014)
2014-07-03 00:00:00