ownCloud CVE-2014-1665 Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

Bugtraq ID:	65457
Class:	Input Validation Error
CVE:	CVE-2014-1665
Remote:	Yes
Local:	No
Published:	Feb 05 2014 12:00AM
Updated:	Feb 05 2014 12:00AM
Credit:	absane
Vulnerable:	ownCloud ownCloud 6.0.0a
Not Vulnerable:	ownCloud ownCloud 6.0.1

ownCloud CVE-2014-1665 Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

ownCloud is prone to multiple cross-site request-forgery vulnerabilities and an HTML-injection vulnerability.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

ownCloud 6.0.0a is vulnerable; other versions may also be affected.

ownCloud CVE-2014-1665 Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

Attackers can exploit these issues using browser. To exploit the cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim to visit a specially-crafted webpage.

The following exploit code is available:

• /data/vulnerabilities/exploits/65457.html.txt

ownCloud CVE-2014-1665 Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ownCloud CVE-2014-1665 Multiple Cross Site Request Forgery and HTML Injection Vulnerabilities

References:

• ownCloud Homepage (ownCloud)