CVE-2013-0304: CSRF
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0304?
CVE-2013-0304 has a medium severity level as it allows remote authenticated users to access other users' calendars.
How do I fix CVE-2013-0304?
To fix CVE-2013-0304, upgrade your ownCloud server to version 4.5.7 or later.
What types of users are affected by CVE-2013-0304?
Remote authenticated users who can access the calendar application are affected by CVE-2013-0304.
What feature does CVE-2013-0304 target in ownCloud?
CVE-2013-0304 targets the calendar export feature in ownCloud, specifically via the calid parameter.
Can CVE-2013-0304 be exploited without authentication?
No, CVE-2013-0304 requires user authentication to exploit the vulnerability.