CVE-2012-4393: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) filessharing/ajax/email.php, (25) filessharing/ajax/setpermissions.php, (26) filessharing/ajax/share.php, (27) filessharing/ajax/toggleresharing.php, (28) filessharing/ajax/togglesharewitheveryone.php, (29) filessharing/ajax/unshare.php, (30) filestexteditor/ajax/savefile.php, (31) filesversions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4393?
CVE-2012-4393 is considered a medium severity vulnerability due to its ability to allow unauthorized actions through CSRF.
How do I fix CVE-2012-4393?
To mitigate CVE-2012-4393, upgrade ownCloud to version 4.0.6 or later, which addresses the CSRF vulnerabilities.
What types of attacks are possible with CVE-2012-4393?
CVE-2012-4393 allows attackers to hijack user authentication and perform actions such as adding, editing, or deleting bookmarks and calendar events.
Which versions of ownCloud are affected by CVE-2012-4393?
CVE-2012-4393 affects all versions of ownCloud prior to 4.0.6, including 3.0.0 to 4.0.5.
Can CVE-2012-4393 be exploited remotely?
Yes, CVE-2012-4393 can be exploited remotely without user interaction, making it a significant security concern.