SB2020022809 - Information disclosure in ownCloud Server
Published: February 28, 2020
Security Bulletin ID
SB2020022809
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Incorrect Use of Privileged APIs (CVE-ID: N/A)
The vulnerability allows a remote attacker to gain access to all file-versions of a user.
The vulnerability exists due to the incorrect usage of privileged APIs. A remote authenticated attacker on the local network can access all versions of all files (even unshared) as soon as the owner of said files has at least one outgoing share with the attacker.
Remediation
Install update from vendor's website.