PT-2012-5366 · Owncloud · Owncloud

Kurt Seifried · Publicado 2012-09-05 · Atualizado 2025-03-31 · CVE-2012-4392

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7

Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value.

Recommendations For ownCloud version 4.0.7, consider updating to a newer version that properly validates the oc token cookie to prevent authentication bypass. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-4392

Produtos afetados

Owncloud

Referências · 6

• 🔥 https://github.com/owncloud/core/commit/4fd069b47906ebcf83887970c732d464dbe7d37a · Exploit
• http://openwall.com/lists/oss-security/2012/09/02/2 · Nota
• http://openwall.com/lists/oss-security/2012/08/11/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4392 · Nota de Segurança
• https://t.me/cvenotify/117018 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4392 · Nota