CVE-2012-5607
First published: Tue Dec 18 2012(Updated: )
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ownCloud | <=4.0.8 | |
| ownCloud | =3.0.0 | |
| ownCloud | =3.0.1 | |
| ownCloud | =3.0.2 | |
| ownCloud | =3.0.3 | |
| ownCloud | =4.0.0 | |
| ownCloud | =4.0.1 | |
| ownCloud | =4.0.2 | |
| ownCloud | =4.0.3 | |
| ownCloud | =4.0.4 | |
| ownCloud | =4.0.5 | |
| ownCloud | =4.0.6 | |
| ownCloud | =4.0.7 | |
| ownCloud | =4.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-5607?
CVE-2012-5607 is considered a high severity vulnerability due to its potential for exploitation through password manipulation.
How do I fix CVE-2012-5607?
To fix CVE-2012-5607, upgrade ownCloud to version 4.0.9 or 4.5.0 or later.
What versions of ownCloud are affected by CVE-2012-5607?
CVE-2012-5607 affects ownCloud versions 4.0.8 and earlier as well as specific versions 3.0.0 to 4.0.7.
What type of attack does CVE-2012-5607 exploit?
CVE-2012-5607 exploits a weakness in the 'Lost Password' reset functionality, allowing for remote timing attacks.
What are the potential consequences of exploiting CVE-2012-5607?
Exploiting CVE-2012-5607 can allow unauthorized remote access to change an account's password.
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/owncloud
- canonical/owncloud
- version/owncloud/4.0.8
- version/owncloud/3.0.0
- version/owncloud/3.0.1
- version/owncloud/3.0.2
- version/owncloud/3.0.3
- version/owncloud/4.0.0
- version/owncloud/4.0.1
- version/owncloud/4.0.2
- version/owncloud/4.0.3
- version/owncloud/4.0.4
- version/owncloud/4.0.5
- version/owncloud/4.0.6
- version/owncloud/4.0.7
- version/owncloud/4.5.0