#VU55561 Permissions, Privileges, and Access Controls in ownCloud Server - CVE-2021-35946
Published: August 4, 2021
Vulnerability identifier: #VU55561
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-35946
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
ownCloud Server
ownCloud Server
Software vendor:
ownCloud
ownCloud
Description
The vulnerability allows a remote authenticated attacker to escalate privileges on the system.
The vulnerability exists due to the federated share recipient can increase permissions, which leads to security restrictions bypass and privilege escalation.
Remediation
Install updates from vendor's website.