ownCloud CVE-2014-2053 XML External Entity Injection vulnerability

Bugtraq ID:	66225
Class:	Design Error
CVE:	CVE-2014-2053
Remote:	Yes
Local:	No
Published:	Mar 07 2014 12:00AM
Updated:	Mar 07 2014 12:00AM
Credit:	Lukas Reschke
Vulnerable:	ownCloud ownCloud 6.0.1 ownCloud ownCloud 5.0.11 ownCloud ownCloud 5.0.10 ownCloud ownCloud 5.0.8 ownCloud ownCloud 5.0.7 ownCloud ownCloud 5.0.6 ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.13 ownCloud ownCloud 4.5.12 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.16 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 6.0.0a ownCloud ownCloud 5.0.9 ownCloud ownCloud 5.0.2 ownCloud ownCloud 5.0.14 ownCloud ownCloud 5.0.13 ownCloud ownCloud 5.0.12 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.5.4 ownCloud ownCloud 4.5.3 ownCloud ownCloud 4.5.1 ownCloud ownCloud 4.0.8 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 4.0.0 ownCloud ownCloud 3.0.3 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 6.0.2 ownCloud ownCloud 5.0.15

ownCloud CVE-2014-2053 XML External Entity Injection vulnerability

ownCloud is prone to XML External Entity injection vulnerability.

Successfully exploiting this issue may allow an attacker to gain unauthorized access; this may aid in further attacks.

Versions prior to ownCloud 6.0.2 and 5.0.15 are vulnerable.

ownCloud CVE-2014-2053 XML External Entity Injection vulnerability

An attacker can exploit this issue using readily available tools.