ownCloud Multiple Security Vulnerabilities
BID:59875
Info
ownCloud Multiple Security Vulnerabilities
| Bugtraq ID: | 59875 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-2039 CVE-2013-2040 CVE-2013-2041 CVE-2013-2042 CVE-2013-2043 CVE-2013-2044 CVE-2013-2045 CVE-2013-2046 CVE-2013-2048 CVE-2013-2085 CVE-2013-2089 |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2013 12:00AM |
| Updated: | May 14 2013 12:00AM |
| Credit: | Reported by vendor, Mateusz Goik and Kacper R. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
ownCloud Multiple Security Vulnerabilities
ownCloud is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple security-bypass vulnerability
4. An arbitrary file-upload vulnerability
5. Multiple directory-traversal vulnerabilities
6. Multiple SQL-injection vulnerabilities
Attackers can exploit these issues to bypass certain security restrictions, gain access to arbitrary files, steal cookie-based authentication information, upload and execute arbitrary PHP code in the context of the web server, redirect an user to a potentially malicious site which may aid in phishing attacks, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.
ownCloud is prone to the following security vulnerabilities:
1. Multiple cross-site scripting vulnerabilities
2. An open-redirection vulnerability
3. Multiple security-bypass vulnerability
4. An arbitrary file-upload vulnerability
5. Multiple directory-traversal vulnerabilities
6. Multiple SQL-injection vulnerabilities
Attackers can exploit these issues to bypass certain security restrictions, gain access to arbitrary files, steal cookie-based authentication information, upload and execute arbitrary PHP code in the context of the web server, redirect an user to a potentially malicious site which may aid in phishing attacks, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.
Exploit / POC
ownCloud Multiple Security Vulnerabilities
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues through a browser. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
ownCloud Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.