CVE-2012-5610: Input Validation
Published Dec 18, 2012
·Updated
Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a special crafted name.
Affected Software
29 affected components
ownCloud ownCloud<=4.0.8
ownCloud ownCloud=3.0.0
ownCloud ownCloud=3.0.1
ownCloud ownCloud=3.0.2
ownCloud ownCloud=3.0.3
ownCloud ownCloud=4.0.0
ownCloud ownCloud=4.0.1
ownCloud ownCloud=4.0.2
ownCloud ownCloud=4.0.3
ownCloud ownCloud=4.0.4
ownCloud ownCloud=4.0.5
ownCloud ownCloud=4.0.6
ownCloud ownCloud=4.0.7
ownCloud ownCloud=4.5.0
ownCloud ownCloud=4.5.1
ownCloud ownCloud Server=3.0.0
ownCloud ownCloud Server=3.0.1
ownCloud ownCloud Server=3.0.2
ownCloud ownCloud Server=3.0.3
ownCloud ownCloud Server=4.0.0
ownCloud ownCloud Server=4.0.1
ownCloud ownCloud Server=4.0.2
ownCloud ownCloud Server=4.0.3
ownCloud ownCloud Server=4.0.4
ownCloud ownCloud Server=4.0.5
ownCloud ownCloud Server=4.0.6
ownCloud ownCloud Server=4.0.7
ownCloud ownCloud Server=4.5.0
ownCloud ownCloud Server=4.5.1
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Dec 18, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·01:55 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2012-5610?
CVE-2012-5610 has a medium severity rating due to its potential for unauthorized remote code execution.
2
How do I fix CVE-2012-5610?
To fix CVE-2012-5610, upgrade to ownCloud version 4.0.9 or later, or 4.5.2 or later.
3
Who is affected by CVE-2012-5610?
CVE-2012-5610 affects ownCloud versions before 4.0.9 and 4.5.x before 4.5.2.
4
What types of attacks can CVE-2012-5610 facilitate?
CVE-2012-5610 can facilitate attacks that allow remote authenticated users to upload malicious files and execute PHP code.
5
What is the impact of exploiting CVE-2012-5610?
Exploiting CVE-2012-5610 could lead to a complete compromise of the affected ownCloud installation.