CVE-2012-5609

Severity

65%

Complexity

80%

Confidentiality

106%

Per: http://cwe.mitre.org/data/definitions/184.html 'CWE-184: Incomplete Blacklist'

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file.

Per: http://cwe.mitre.org/data/definitions/184.html 'CWE-184: Incomplete Blacklist'

CVSS 2.0 Base Score 6.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P).

Overview

First reported 12 years ago

2012-12-18 01:55:00

Last updated 12 years ago

2012-12-19 05:00:00

Affected Software

ownCloud 3.0.0

3.0.0

ownCloud 3.0.1

3.0.1

ownCloud 3.0.2

3.0.2

ownCloud 3.0.3

3.0.3

ownCloud 4.0.0

4.0.0

ownCloud 4.0.1

4.0.1

ownCloud 4.0.2

4.0.2

ownCloud 4.0.3

4.0.3

ownCloud 4.0.4

4.0.4

ownCloud 4.0.5

4.0.5

ownCloud 4.0.6

4.0.6

ownCloud 4.0.7

4.0.7

ownCloud 4.0.8

4.0.8

ownCloud 4.0.9

4.0.9

ownCloud 4.5.0

4.5.0

ownCloud

References

http://owncloud.org/changelog/

http://owncloud.org/security/advisories/oc-sa-2012-004/

Patch, Vendor Advisory

51357

Vendor Advisory

[oss-security] 20121130 Re: CVE Request: owncloud

https://github.com/owncloud/core/commit/4619c66

Patch

https://github.com/owncloud/core/commit/e8a0cea