ownCloud CVE-2017-9340 Remote Privilege Escalation Vulnerability

Bugtraq ID:	99325
Class:	Design Error
CVE:	CVE-2017-9340
Remote:	Yes
Local:	No
Published:	May 31 2017 12:00AM
Updated:	May 31 2017 12:00AM
Credit:	Elamaran Venkatraman
Vulnerable:	ownCloud ownCloud 10.0.1 ownCloud ownCloud 10.0 ownCloud ownCloud 9.1.6 ownCloud ownCloud 9.1.5 ownCloud ownCloud 9.1.1 ownCloud ownCloud 9.0.10 ownCloud ownCloud 9.0.9 ownCloud ownCloud 9.0.5 ownCloud ownCloud 9.0.3 ownCloud ownCloud 9.0.2 ownCloud ownCloud 9.0.1 ownCloud ownCloud 8.2.12 ownCloud ownCloud 8.2.11 ownCloud ownCloud 8.2.6 ownCloud ownCloud 8.2.2 ownCloud ownCloud 8.1.8 ownCloud ownCloud 8.1.5 ownCloud ownCloud 8.1.2 ownCloud ownCloud 8.1.1 ownCloud ownCloud 8.1 ownCloud ownCloud 8.0.10 ownCloud ownCloud 8.0.7 ownCloud ownCloud 8.0.6 ownCloud ownCloud 8.0.5 ownCloud ownCloud 8.0.4 ownCloud ownCloud 8.0.3 ownCloud ownCloud 8.0.2 ownCloud ownCloud 8.0.1 ownCloud ownCloud 8.0 ownCloud ownCloud 7.0.12 ownCloud ownCloud 7.0.9 ownCloud ownCloud 7.0.8 ownCloud ownCloud 7.0.6 ownCloud ownCloud 7.0.3 ownCloud ownCloud 7.0.2 ownCloud ownCloud 7.0.1 ownCloud ownCloud 7.0 ownCloud ownCloud 6.0.8 ownCloud ownCloud 6.0.6 ownCloud ownCloud 6.0.4 ownCloud ownCloud 6.0.1 ownCloud ownCloud 5.0.18 ownCloud ownCloud 5.0.11 ownCloud ownCloud 5.0.10 ownCloud ownCloud 5.0.8 ownCloud ownCloud 5.0.7 ownCloud ownCloud 5.0.6 ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.13 ownCloud ownCloud 4.5.12 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.16 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 2.2.3 ownCloud ownCloud 2.2.2 ownCloud ownCloud 9.1.2 ownCloud ownCloud 9.0.6 ownCloud ownCloud 9.0.4 ownCloud ownCloud 9.0 ownCloud ownCloud 8.2.9 ownCloud ownCloud 8.2.7 ownCloud ownCloud 8.1.9 ownCloud ownCloud 8.1.4 ownCloud ownCloud 8.0.9 ownCloud ownCloud 8.0.14 ownCloud ownCloud 7.0.5 ownCloud ownCloud 7.0.4 ownCloud ownCloud 6.0.7 ownCloud ownCloud 6.0.5 ownCloud ownCloud 6.0.3 ownCloud ownCloud 6.0.2 ownCloud ownCloud 6.0.0a ownCloud ownCloud 6.0.0 ownCloud ownCloud 5.0.9 ownCloud ownCloud 5.0.2 ownCloud ownCloud 5.0.19 ownCloud ownCloud 5.0.17 ownCloud ownCloud 5.0.16 ownCloud ownCloud 5.0.15 ownCloud ownCloud 5.0.14 A ownCloud ownCloud 5.0.14 ownCloud ownCloud 5.0.13 ownCloud ownCloud 5.0.12 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.5.4 ownCloud ownCloud 4.5.3 ownCloud ownCloud 4.5.1 ownCloud ownCloud 4.0.8 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 4.0.0 ownCloud ownCloud 3.0.3 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0
Not Vulnerable:	ownCloud ownCloud 10.0.2

ownCloud CVE-2017-9340 Remote Privilege Escalation Vulnerability

ownCloud is prone to a remote privilege-escalation vulnerability.

Remote attackers can exploit this issue to gain elevated privileges.

Versions prior to ownCloud Server 10.0.2 are vulnerable.

ownCloud CVE-2017-9340 Remote Privilege Escalation Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ownCloud CVE-2017-9340 Remote Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

ownCloud CVE-2017-9340 Remote Privilege Escalation Vulnerability

References:

• ownCloud Homepage (ownCloud)
  
• Normal user can somehow make admin to delete shared folders (oC-SA-2017-006) (ownCloud)
  
• Privilege escalation - Normal user can somehow make admin to delete shared folde (Hackerone)