ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
BID:56658
Info
ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 56658 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 23 2012 12:00AM |
| Updated: | Nov 23 2012 12:00AM |
| Credit: | Shai Rod, Felix Richter and the vendor reported these issues. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
ownCloud is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple arbitrary-file-upload vulnerabilities
Attackers can exploit these issues to steal cookie-based authentication information, execute arbitrary scripts in the context of the browser, upload and execute arbitrary files in the context of the webserver, and launch other attacks.
ownCloud is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. Multiple arbitrary-file-upload vulnerabilities
Attackers can exploit these issues to steal cookie-based authentication information, execute arbitrary scripts in the context of the browser, upload and execute arbitrary files in the context of the webserver, and launch other attacks.
Exploit / POC
ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
ownCloud Multiple Cross Site Scripting and Arbitrary File Upload Vulnerabilities
References:
References:
- ownCloud Homepage (ownCloud)