PT-2015-2573 · Owncloud · Owncloud Server

Publicado 2015-10-18 · Atualizado 2016-12-07 · CVE-2015-4716

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 7.0.0 through 7.0.6 ownCloud Server versions 8.0.0 through 8.0.4

Description The issue is related to a directory traversal vulnerability in the routing component of ownCloud Server. This vulnerability allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors when running on Windows. The vulnerability exists due to incorrect restriction of the path name to a directory with limited access.

Recommendations For ownCloud Server versions 7.0.0 through 7.0.6, update to version 7.0.6 or later. For ownCloud Server versions 8.0.0 through 8.0.4, update to version 8.0.4 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2015-11938

CVE-2015-4716

DSA-3373-1

Produtos afetados

Owncloud Server

Referências · 25

• https://bdu.fstec.ru/vul/2015-11945 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5954 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5953 · Nota de Segurança
• http://securityfocus.com/bid/76159 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4717 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11937 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-3373-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3373-1 · Aviso do Fabricante
• https://packages.debian.org/src:owncloud · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6500 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11826 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11938 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4716 · Nota de Segurança
• https://owncloud.org/security/advisory/?id=oc-sa-2015-006 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4718 · Nota de Segurança