ownCloud CVE-2013-2085 Directory Traversal Vulnerability

Bugtraq ID:	59949
Class:	Input Validation Error
CVE:	CVE-2013-2085
Remote:	Yes
Local:	No
Published:	May 14 2013 12:00AM
Updated:	May 14 2013 12:00AM
Credit:	Mateusz Goik
Vulnerable:	ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 5.0.6

ownCloud CVE-2013-2085 Directory Traversal Vulnerability

ownCloud is prone to a directory-traversal vulnerability.

An attacker can exploit this issue using directory-traversal strings to retrieve arbitrary files outside of the server root directory. This may aid in further attacks.

Note: This issue was previously discussed in BID 59875 (ownCloud Multiple Security Vulnerabilities), but has been moved to its own record for better documentation.

Versions prior to ownCloud Server 5.0.6 are vulnerable.

ownCloud CVE-2013-2085 Directory Traversal Vulnerability

Attackers can exploit this issues through a browser.

ownCloud CVE-2013-2085 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ownCloud CVE-2013-2085 Directory Traversal Vulnerability

References:

• ownCloud Homepage (ownCloud)
  
• Multiple directory traversals (oC-SA-2013-020) (ownCloud)