ownCloud CVE-2013-2044 Open Redirection Vulnerability

Bugtraq ID:	59962
Class:	Input Validation Error
CVE:	CVE-2013-2044
Remote:	Yes
Local:	No
Published:	May 14 2013 12:00AM
Updated:	May 14 2013 12:00AM
Credit:	Mateusz Goik
Vulnerable:	ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 5.0.6

ownCloud CVE-2013-2044 Open Redirection Vulnerability

ownCloud is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Note: This issue was previously discussed in BID 59875 (ownCloud Multiple Security Vulnerabilities), but has been moved to its own record for better documentation.

Versions prior to ownCloud 5.0.6 are vulnerable.