Vulnerabilities > CVE-2013-1851 - Unspecified vulnerability in Owncloud

CVSS 3.5 - LOW

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

SINGLE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

owncloud

NVD

Published: 2014-03-14

Updated: 2014-03-26

Summary

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors. Per: https://cwe.mitre.org/data/definitions/184.html "CWE-184: Incomplete Blacklist"

Vulnerable Configurations

Part	Description	Count
Application	Owncloud Owncloud Owncloud 3.0.0 Owncloud Owncloud 3.0.1 Owncloud Owncloud 3.0.2 Owncloud Owncloud 3.0.3 Owncloud Owncloud 4.0.0 Owncloud Owncloud 4.0.1 Owncloud Owncloud 4.0.2 Owncloud Owncloud 4.0.3 Owncloud Owncloud 4.0.4 Owncloud Owncloud 4.0.5 Owncloud Owncloud 4.0.6 Owncloud Owncloud 4.0.7 Owncloud Owncloud 4.0.8 Owncloud Owncloud 4.0.9 Owncloud Owncloud 4.0.10 Owncloud Owncloud 4.0.11 Owncloud Owncloud - Owncloud Owncloud 3.4.3 Owncloud Owncloud 4.0.12 Owncloud Owncloud 4.5.0 Owncloud Owncloud 4.5.1 Owncloud Owncloud 4.5.2 Owncloud Owncloud 4.5.3 Owncloud Owncloud 4.5.4 Owncloud Owncloud 4.5.5 Owncloud Owncloud 4.5.6 Owncloud Owncloud 4.5.7	27

References

http://owncloud.org/about/security/advisories/oC-SA-2013-010/