Code injection

2021-02-0918:15:00

PRIOn knowledge base

www.prio-n.com

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.9%

JSON

When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files, and another user uploads a virus the files antivirus app would detect the virus but fails to delete it due to permission issues. This affects the files_antivirus component versions before 0.15.2 for ownCloud.

CPENameOperatorVersion
files_antiviruslt0.15.2

CPE	Name	Operator	Version
	files_antivirus	lt	0.15.2

References

owncloud.com/security-advisories/files-antivirus-doesnt-delete-virus-if-uploaded-through-public-link/