PT-2012-5367 · Owncloud · Owncloud
Kurt Seifried
·
Publicado
2012-09-05
·
Atualizado
2025-03-31
·
CVE-2012-4393
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
ownCloud versions prior to 4.0.6
Description
The issue affects ownCloud, allowing remote attackers to hijack the authentication of arbitrary users for various requests. This is due to multiple cross-site request forgery (CSRF) vulnerabilities in several PHP files, including those in the bookmarks, calendar, and settings directories. The estimated number of potentially affected devices and details about real-world incidents are not provided. Technical details include the exploitation of API endpoints such as "addBookmark.php", "delBookmark.php", "editBookmark.php", and many others, which are vulnerable to CSRF attacks. Variables and function names are not explicitly mentioned as vulnerable.
Recommendations
For ownCloud versions prior to 4.0.6, update to version 4.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is applied. Avoid using the affected PHP files in the bookmarks, calendar, and settings directories until the issue is resolved. Additionally, restrict access to the administrators' requests that use the vulnerable PHP files in the settings/ajax/ directory.
Exploit
Correção
CSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Owncloud