PT-2019-6838 · Owncloud · Owncloud

Publicado 2019-11-22 · Atualizado 2019-12-02 · CVE-2013-0203

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.10 through 4.5.5 ownCloud versions prior to 4.0.10

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the unspecified parameters to "apps/calendar/ajax/event/new.php" or the url parameter to "apps/bookmarks/ajax/addBookmark.php".

Recommendations For ownCloud versions 4.0.10 through 4.5.5, consider disabling access to the "apps/calendar/ajax/event/new.php" and "apps/bookmarks/ajax/addBookmark.php" API endpoints until a fix is available. For ownCloud versions prior to 4.0.10, restrict the use of unspecified parameters in "apps/calendar/ajax/event/new.php" and the url parameter in "apps/bookmarks/ajax/addBookmark.php" to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-0203

Produtos afetados

Owncloud

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/81478 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0203 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0203 · Nota
• https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3 · Aviso do Fabricante