Improper Control of Resource Identifiers ('Resource Injection') in ownCloud Desktop App - CVE-2021-44537
Published: January 26, 2022
Vulnerability identifier: #VU60008
CSH Severity: Low
CVSS v4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-44537
CWE-ID: CWE-99
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to missing validation of URLs. A remote administrator can perform a resource injection attack and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
ownCloud Desktop App
Fedora
owncloud-client
Fedora
owncloud-client
How to mitigate CVE-2021-44537
Install updates from vendor's website.
ownCloud Desktop App - update to 2.9.2
owncloud-client - addressed in versions 2.10.1-1.fc35, 2.10.1-1.fc36
owncloud-client - addressed in versions 2.10.1-1.fc35, 2.10.1-1.fc36