PT-2012-5371 · Owncloud · Owncloud

Kurt Seifried · Published 2012-09-05 · Updated 2012-09-06 · CVE-2012-4397

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can occur through the calendar display name in certain PHP files within the apps/calendar/templates directory, or through unspecified vectors in the apps/contacts/lib/vcard.php file.

Recommendations For ownCloud versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected PHP files, such as part.choosecalendar.rowfields.php and part.choosecalendar.rowfields.shared.php in apps/calendar/templates/, and apps/contacts/lib/vcard.php, until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-4397

Affected Products

Owncloud

References · 7

• 🔥 https://github.com/owncloud/core/commit/00595351400523168e18a08e3ffa5c3b1e7c1f6e · Exploit
• https://github.com/owncloud/core/commit/54a371700554ed21a5cb7db03126b6c95ae4cbd3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-4397 · Security Note
• http://openwall.com/lists/oss-security/2012/09/02/2 · Note
• http://openwall.com/lists/oss-security/2012/08/11/1 · Note
• http://owncloud.org/changelog · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4397 · Note