PT-2012-3910 · Owncloud · Owncloud

Lukas Reschke · Publicado 2012-04-20 · Atualizado 2025-03-31 · CVE-2012-2270

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 3.0.3

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect url parameter in the index.php file, also known as the Login Page.

Recommendations For versions prior to 3.0.3, update to version 3.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the index.php file or avoiding the use of the redirect url parameter until the update is applied.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-2270

Produtos afetados

Owncloud

Referências · 14

• 🔥 http://tele-consulting.com/advisories/TC-SA-2012-01.txt · Exploit
• 🔥 https://exploit-db.com/exploits/37094 · Exploit
• http://osvdb.org/81211 · Nota
• http://openwall.com/lists/oss-security/2012/09/02/2 · Nota
• https://t.me/cvenotify/117012 · Publicação no Telegram
• http://secunia.com/advisories/48850 · Aviso do Fabricante
• http://owncloud.org/security/advisories/CVE-2012-2270 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75029 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2270 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/08/11/1 · Nota
• http://packetstormsecurity.org/files/111956/ownCloud-3.0.0-Cross-Site-Scripting.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2012-04/0127.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2270 · Nota
• http://securityfocus.com/bid/53145 · Nota