CVE-2012-5606: XSS
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/filesversions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5606?
CVE-2012-5606 is rated as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-5606?
To fix CVE-2012-5606, upgrade ownCloud to version 4.0.9 or later, or 4.5.0 or later.
What types of attacks can CVE-2012-5606 facilitate?
CVE-2012-5606 can facilitate remote cross-site scripting (XSS) attacks by allowing attackers to inject arbitrary web scripts.
Which versions of ownCloud are affected by CVE-2012-5606?
CVE-2012-5606 affects ownCloud versions before 4.0.9 and specific versions in the 3.x range up to 4.5.0.
What are the key components involved in CVE-2012-5606?
Key components involved in CVE-2012-5606 include the files_versions.js and filelist.js scripts, along with event titles in the fullcalendar component.