PT-2022-10290 · Owncloud · Owncloud

Published 2022-01-15 · Updated 2022-01-21 · CVE-2021-33828

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ownCloud files antivirus component versions prior to 1.0.0

Description The issue arises from the mishandling of the protection mechanism in the files antivirus component. This mechanism is supposed to delete malicious files that have been uploaded to a public share upon detection. However, due to this issue, such files may not be properly deleted, posing a risk.

Recommendations For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider manually monitoring and deleting malicious files uploaded to public shares until the update can be applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-33828

Affected Products

Owncloud

References · 6

• https://doc.owncloud.com/server/admin_manual/release_notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33828 · Security Note
• https://owncloud.com/security-advisories/cve-2021-33828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33828 · Vendor Advisory
• https://t.me/cibsecurity/35647 · Telegram Post
• https://t.me/cvenotify/25537 · Telegram Post