Vulnerabilities > CVE-2013-2089 - Unspecified vulnerability in Owncloud
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN owncloud
nessus
Summary
Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.
Vulnerable Configurations
Nessus
| NASL family | FreeBSD Local Security Checks |
| NASL id | FREEBSD_PKG_D7A43EE6D2D511E29894002590082AC6.NASL |
| description | The ownCloud development team reports : oC-SA-2013-019 / CVE-2013-2045: Multiple SQL Injections. Credit to Mateusz Goik (aliantsoft.pl). oC-SA-2013-020 / CVE-2013-[2039,2085]: Multiple directory traversals. Credit to Mateusz Goik (aliantsoft.pl). oC-SQ-2013-021 / CVE-2013-[2040-2042]: Multiple XSS vulnerabilities. Credit to Mateusz Goik (aliantsoft.pl) and Kacper R. (http://devilteam.pl). oC-SA-2013-022 / CVE-2013-2044: Open redirector. Credit to Mateusz Goik (aliantsoft.pl). oC-SA-2013-023 / CVE-2013-2047: Password autocompletion. oC-SA-2013-024 / CVE-2013-2043: Privilege escalation in the calendar application. Credit to Mateusz Goik (aliantsoft.pl). oC-SA-2013-025 / CVE-2013-2048: Privilege escalation and CSRF in the API. oC-SA-2013-026 / CVE-2013-2089: Incomplete blacklist vulnerability. oC-SA-2013-027 / CVE-2013-2086: CSRF token leakage. oC-SA-2013-028 / CVE-2013-[2149-2150]: Multiple XSS vulnerabilities. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 66875 |
| published | 2013-06-12 |
| reporter | This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/66875 |
| title | FreeBSD : owncloud -- Multiple security vulnerabilities (d7a43ee6-d2d5-11e2-9894-002590082ac6) |