CVE-2012-5336: Input Validation
Published Jun 4, 2014
·Updated
lib/base.php in ownCloud before 4.0.8 does not properly validate the userid session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
Affected Software
15 affected components
ownCloud ownCloud<=4.0.7
ownCloud ownCloud=4.0.0
ownCloud ownCloud=4.0.1
ownCloud ownCloud=4.0.2
ownCloud ownCloud=4.0.3
ownCloud ownCloud=4.0.4
ownCloud ownCloud=4.0.5
ownCloud ownCloud=4.0.6
ownCloud ownCloud Server=4.0.0
ownCloud ownCloud Server=4.0.1
ownCloud ownCloud Server=4.0.2
ownCloud ownCloud Server=4.0.3
ownCloud ownCloud Server=4.0.4
ownCloud ownCloud Server=4.0.5
ownCloud ownCloud Server=4.0.6
Event History
Jun 4, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-5336?
CVE-2012-5336 is classified as a medium severity vulnerability.
2
How do I fix CVE-2012-5336?
To fix CVE-2012-5336, upgrade ownCloud to version 4.0.8 or later.
3
What versions of ownCloud are affected by CVE-2012-5336?
CVE-2012-5336 affects ownCloud versions prior to 4.0.8, including versions 4.0.0 to 4.0.7.
4
What type of vulnerability is CVE-2012-5336?
CVE-2012-5336 is a session validation vulnerability that allows arbitrary file reading.
5
Who can exploit CVE-2012-5336?
CVE-2012-5336 can be exploited by remote authenticated users with access to the affected ownCloud instance.