PT-2019-6838 · Owncloud · Owncloud

Published 2019-11-22 · Updated 2019-12-02 · CVE-2013-0203

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.10 through 4.5.5 ownCloud versions prior to 4.0.10

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the unspecified parameters to "apps/calendar/ajax/event/new.php" or the url parameter to "apps/bookmarks/ajax/addBookmark.php".

Recommendations For ownCloud versions 4.0.10 through 4.5.5, consider disabling access to the "apps/calendar/ajax/event/new.php" and "apps/bookmarks/ajax/addBookmark.php" API endpoints until a fix is available. For ownCloud versions prior to 4.0.10, restrict the use of unspecified parameters in "apps/calendar/ajax/event/new.php" and the url parameter in "apps/bookmarks/ajax/addBookmark.php" to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-0203

Affected Products

Owncloud

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-0203 · Security Note
• https://owncloud.org/security/advisories/multiple-xss-vulnerabilities-3 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/81478 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0203 · Note