PT-2012-5366 · Owncloud · Owncloud

Kurt Seifried · Published 2012-09-05 · Updated 2025-03-31 · CVE-2012-4392

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ownCloud version 4.0.7

Description The issue concerns improper validation of the oc token cookie in the index.php file, allowing remote attackers to bypass authentication by crafting a specific oc token cookie value.

Recommendations For ownCloud version 4.0.7, consider updating to a newer version that properly validates the oc token cookie to prevent authentication bypass. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-4392

Affected Products

Owncloud

References · 6

• 🔥 https://github.com/owncloud/core/commit/4fd069b47906ebcf83887970c732d464dbe7d37a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4392 · Security Note
• http://openwall.com/lists/oss-security/2012/09/02/2 · Note
• http://openwall.com/lists/oss-security/2012/08/11/1 · Note
• https://t.me/cvenotify/117018 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4392 · Note