ownCloud CVE-2014-2056 XML External Entity Injection vulnerability

Bugtraq ID:	66218
Class:	Design Error
CVE:	CVE-2014-2056
Remote:	Yes
Local:	No
Published:	Mar 07 2014 12:00AM
Updated:	Mar 07 2014 12:00AM
Credit:	Lukas Reschke
Vulnerable:	ownCloud ownCloud 6.0.1 ownCloud ownCloud 5.0.11 ownCloud ownCloud 5.0.10 ownCloud ownCloud 5.0.8 ownCloud ownCloud 5.0.7 ownCloud ownCloud 5.0.6 ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.13 ownCloud ownCloud 4.5.12 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.16 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 6.0.0a ownCloud ownCloud 5.0.9 ownCloud ownCloud 5.0.2 ownCloud ownCloud 5.0.14 ownCloud ownCloud 5.0.13 ownCloud ownCloud 5.0.12 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.5.4 ownCloud ownCloud 4.5.3 ownCloud ownCloud 4.5.1 ownCloud ownCloud 4.0.8 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 4.0.0 ownCloud ownCloud 3.0.3 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 6.0.2 ownCloud ownCloud 5.0.15

ownCloud CVE-2014-2056 XML External Entity Injection vulnerability

ownCloud is prone to XML External Entity injection vulnerability.

Successfully exploiting this issue may allow an attacker to gain unauthorized access; this may aid in further attacks.

Versions prior to ownCloud 6.0.2 and 5.0.15 are vulnerable.