CVE-2012-5607: Medium severity ownCloud ownCloud vulnerability
Published Dec 18, 2012
·Updated
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."
Affected Software
27 affected components
ownCloud ownCloud<=4.0.8
ownCloud ownCloud=3.0.0
ownCloud ownCloud=3.0.1
ownCloud ownCloud=3.0.2
ownCloud ownCloud=3.0.3
ownCloud ownCloud=4.0.0
ownCloud ownCloud=4.0.1
ownCloud ownCloud=4.0.2
ownCloud ownCloud=4.0.3
ownCloud ownCloud=4.0.4
ownCloud ownCloud=4.0.5
ownCloud ownCloud=4.0.6
ownCloud ownCloud=4.0.7
ownCloud ownCloud=4.5.0
ownCloud ownCloud Server=3.0.0
ownCloud ownCloud Server=3.0.1
ownCloud ownCloud Server=3.0.2
ownCloud ownCloud Server=3.0.3
ownCloud ownCloud Server=4.0.0
ownCloud ownCloud Server=4.0.1
ownCloud ownCloud Server=4.0.2
ownCloud ownCloud Server=4.0.3
ownCloud ownCloud Server=4.0.4
ownCloud ownCloud Server=4.0.5
ownCloud ownCloud Server=4.0.6
ownCloud ownCloud Server=4.0.7
ownCloud ownCloud Server=4.5.0
Remediation
Patch Available
Patch Available
Patch Available
Event History
Dec 18, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-5607?
CVE-2012-5607 is considered a high severity vulnerability due to its potential for exploitation through password manipulation.
2
How do I fix CVE-2012-5607?
To fix CVE-2012-5607, upgrade ownCloud to version 4.0.9 or 4.5.0 or later.
3
What versions of ownCloud are affected by CVE-2012-5607?
CVE-2012-5607 affects ownCloud versions 4.0.8 and earlier as well as specific versions 3.0.0 to 4.0.7.
4
What type of attack does CVE-2012-5607 exploit?
CVE-2012-5607 exploits a weakness in the 'Lost Password' reset functionality, allowing for remote timing attacks.
5
What are the potential consequences of exploiting CVE-2012-5607?
Exploiting CVE-2012-5607 can allow unauthorized remote access to change an account's password.