CVE-2013-0300: CSRF

Published Mar 14, 2014

Updated

Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/filesexternal/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/userwebdavauth/settings.php.

Affected Software

14 affected components

ownCloud ownCloud=4.5.0

ownCloud ownCloud=4.5.1

ownCloud ownCloud=4.5.2

ownCloud ownCloud=4.5.3

ownCloud ownCloud=4.5.4

ownCloud ownCloud=4.5.5

ownCloud ownCloud=4.5.6

ownCloud ownCloud Server=4.5.0

ownCloud ownCloud Server=4.5.1

ownCloud ownCloud Server=4.5.2

ownCloud ownCloud Server=4.5.3

ownCloud ownCloud Server=4.5.4

ownCloud ownCloud Server=4.5.5

ownCloud ownCloud Server=4.5.6

Event History

Mar 14, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Data Sourced

via NVD·05:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-0300?

CVE-2013-0300 is considered a medium severity vulnerability due to its potential for cross-site request forgery (CSRF) attacks.

How do I fix CVE-2013-0300?

To fix CVE-2013-0300, upgrade your ownCloud server to version 4.5.7 or later.

What versions are affected by CVE-2013-0300?

CVE-2013-0300 affects ownCloud versions 4.5.0 through 4.5.6.

What types of attacks are associated with CVE-2013-0300?

CVE-2013-0300 allows remote attackers to perform cross-site request forgery attacks such as changing the default view in the calendar or mounting arbitrary Google Drive.

Can CVE-2013-0300 allow for user authentication hijacking?

Yes, CVE-2013-0300 can hijack user authentication by exploiting CSRF vulnerabilities.