Multiple vulnerabilities in ownCloud Server

Published: 2021-08-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2021-35946 CVE-2021-35947 CVE-2021-35948 CVE-2021-35949
CWE-ID	CWE-264 CWE-200 CWE-384 CWE-424
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	ownCloud Server Web applications / Modules and components for CMS
Vendor	ownCloud

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55561

Risk: Medium

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35946

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to escalate privileges on the system.

The vulnerability exists due to the federated share recipient can increase permissions, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ownCloud Server: 10.0 - 10.7.0

CPE2.3

External links

http://owncloud.com/security-advisories/cve-2021-35946/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU55564

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35947

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote authenticated attacker can display the internal path and username of the share owner.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ownCloud Server: 10.0 - 10.7.0

CPE2.3

External links

http://owncloud.com/security-advisories/cve-2021-35947/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Session Fixation

EUVDB-ID: #VU55563

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35948

CWE-ID: CWE-384 - Session Fixation

Exploit availability: No

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the session cookies are not reset after authenticating for public linkse. A remote attacker can obtain sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ownCloud Server: 10.0 - 10.7.0

CPE2.3

External links

http://owncloud.com/security-advisories/cve-2021-35948/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Protection of Alternate Path

EUVDB-ID: #VU55562

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-35949

CWE-ID: CWE-424 - Improper Protection of Alternate Path

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerabiity exists due to the permission check for a file drop can be circumvented by using the shareinfo API. A remote authenticated attacker can see the files in the filedrop.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ownCloud Server: 10.0 - 10.7.0

CPE2.3

External links

http://owncloud.com/security-advisories/cve-2021-35949/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.