CVE-2013-1822: XSS

Published Mar 14, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.

Affected Software

16 affected components

ownCloud ownCloud=4.5.0

ownCloud ownCloud=4.5.1

ownCloud ownCloud=4.5.2

ownCloud ownCloud=4.5.3

ownCloud ownCloud=4.5.4

ownCloud ownCloud=4.5.5

ownCloud ownCloud=4.5.6

ownCloud ownCloud=4.5.7

ownCloud ownCloud Server=4.5.0

ownCloud ownCloud Server=4.5.1

ownCloud ownCloud Server=4.5.2

ownCloud ownCloud Server=4.5.3

ownCloud ownCloud Server=4.5.4

ownCloud ownCloud Server=4.5.5

ownCloud ownCloud Server=4.5.6

ownCloud ownCloud Server=4.5.7

Event History

Mar 14, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-1822?

CVE-2013-1822 is considered a moderate severity vulnerability due to its potential for misuse by authenticated users with administrator privileges.

How do I fix CVE-2013-1822?

To fix CVE-2013-1822, upgrade ownCloud to version 4.5.8 or later.

Who is affected by CVE-2013-1822?

CVE-2013-1822 affects ownCloud versions 4.5.0 to 4.5.7, particularly users with administrator privileges.

What types of attacks are possible with CVE-2013-1822?

CVE-2013-1822 allows for cross-site scripting (XSS) attacks, enabling the injection of arbitrary web scripts or HTML.

What are the implications of CVE-2013-1822 for my ownCloud installation?

The implications of CVE-2013-1822 include potential data exposure and unauthorized actions carried out using injected scripts if not mitigated.