ownCloud CVE-2013-2039 Directory Traversal Vulnerability

Bugtraq ID:	59947
Class:	Input Validation Error
CVE:	CVE-2013-2039
Remote:	Yes
Local:	No
Published:	May 14 2013 12:00AM
Updated:	Apr 13 2015 09:52PM
Credit:	Mateusz Goik
Vulnerable:	ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 5.0.6 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.0.15

ownCloud CVE-2013-2039 Directory Traversal Vulnerability

ownCloud is prone to a directory-traversal vulnerability.

An attacker can exploit this issue using directory-traversal strings to retrieve arbitrary files outside of the server root directory. This may aid in further attacks.

Note: This issue was previously discussed in BID 59875 (ownCloud Multiple Security Vulnerabilities), but has been moved to its own record for better documentation.

ownCloud versions prior to 4.0.15, 4.5.11 and 5.0.6 are vulnerable.

ownCloud CVE-2013-2039 Directory Traversal Vulnerability

Attackers can exploit this issues through a browser.

ownCloud CVE-2013-2039 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ownCloud CVE-2013-2039 Directory Traversal Vulnerability

References:

• ownCloud Homepage (ownCloud)
  
• Multiple directory traversals (oC-SA-2013-020) (ownCloud)