ownCloud CVE-2012-4394 Cross-Site Scripting Vulnerability

Bugtraq ID:	73596
Class:	Input Validation Error
CVE:	CVE-2012-4394
Remote:	Yes
Local:	No
Published:	Sep 05 2012 12:00AM
Updated:	Sep 05 2012 12:00AM
Credit:	Unknown
Vulnerable:	ownCloud ownCloud 4.0.4 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.1 ownCloud ownCloud 4.0.0 ownCloud ownCloud 3.0.3 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:

ownCloud CVE-2012-4394 Cross-Site Scripting Vulnerability

ownCloud is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.

ownCloud CVE-2012-4394 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

ownCloud CVE-2012-4394 Cross-Site Scripting Vulnerability

References:

• http://www.openwall.com/lists/oss-security/2012/08/11/1 (MISC)
  
• http://www.openwall.com/lists/oss-security/2012/09/02/2 (MISC)
  
• Sanitizing file names ( LukasReschke)