Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | N/A |
CWE-ID | CWE-648 |
Exploitation vector | Local network |
Public exploit | N/A |
Vulnerable software Subscribe |
ownCloud Server Web applications / Modules and components for CMS |
Vendor | ownCloud |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU25684
Risk: Low
CVSSv3.1:
CVE-ID: N/A
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to all file-versions of a user.
The vulnerability exists due to the incorrect usage of privileged APIs. A remote authenticated attacker on the local network can access all versions of all files (even unshared) as soon as the owner of said files has at least one outgoing share with the attacker.
MitigationInstall updates from vendor's website.
Vulnerable software versionsownCloud Server: 10.0.9 - 10.3.0
Fixed software versionsCPE2.3 External links
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?