PT-2015-2462 · Owncloud · Owncloud Server

Published 2015-10-18 · Updated 2017-11-04 · CVE-2015-5953

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ownCloud Server versions prior to 7.0.5 ownCloud Server versions 8.0.x prior to 8.0.4

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a double quote character in a filename in a shared folder. This is due to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to inject arbitrary web or HTML code using special symbols in file names within a shared directory.

Recommendations For ownCloud Server versions prior to 7.0.5, update to version 7.0.5 or later. For ownCloud Server versions 8.0.x prior to 8.0.4, update to version 8.0.4 or later. As a temporary workaround, consider restricting the use of special characters in file names within shared folders to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11827

CVE-2015-5953

DSA-3373-1

Affected Products

Owncloud Server

References · 24

• https://bdu.fstec.ru/vul/2015-11945 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5954 · Security Note
• https://owncloud.org/security/advisory/?id=oc-sa-2015-010 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5953 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4717 · Security Note
• https://bdu.fstec.ru/vul/2015-11937 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3373-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3373-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6500 · Security Note
• https://bdu.fstec.ru/vul/2015-11826 · Security Note
• https://bdu.fstec.ru/vul/2015-11938 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4716 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4718 · Security Note
• https://bdu.fstec.ru/vul/2015-11936 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7699 · Security Note