ownCloud CVE-2013-2150 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	60416
Class:	Input Validation Error
CVE:	CVE-2013-2150
Remote:	Yes
Local:	No
Published:	Jun 07 2013 12:00AM
Updated:	Jun 17 2013 05:17PM
Credit:	Mateusz Goik
Vulnerable:	ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:

ownCloud CVE-2013-2150 Multiple Cross Site Scripting Vulnerabilities

ownCloud is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

ownCloud versions prior to 4.5.12 and 5.0.7 are vulnerable.

ownCloud CVE-2013-2150 Multiple Cross Site Scripting Vulnerabilities

An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.

ownCloud CVE-2013-2150 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva owncloud-5.0.7-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

ownCloud CVE-2013-2150 Multiple Cross Site Scripting Vulnerabilities

References:

• ownCloud Homepage (ownCloud)