CVE-2013-2041: XSS

Published Mar 14, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tag parameter to apps/bookmarks/ajax/addBookmark.php or (2) dir parameter to apps/files/ajax/newfile.php, which is passed to apps/files/js/files.js.

Affected Software

12 affected components

ownCloud ownCloud=5.0.0

ownCloud ownCloud=5.0.1

ownCloud ownCloud=5.0.2

ownCloud ownCloud=5.0.3

ownCloud ownCloud=5.0.4

ownCloud ownCloud=5.0.5

ownCloud ownCloud Server=5.0.0

ownCloud ownCloud Server=5.0.1

ownCloud ownCloud Server=5.0.2

ownCloud ownCloud Server=5.0.3

ownCloud ownCloud Server=5.0.4

ownCloud ownCloud Server=5.0.5

Remediation

Patch Available

http://owncloud.org/about/security/advisories/oC-SA-2013-021/

Event History

Mar 14, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:55 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-2041?

CVE-2013-2041 has a medium severity level due to the potential for authenticated users to exploit cross-site scripting vulnerabilities.

How do I fix CVE-2013-2041?

To fix CVE-2013-2041, you must upgrade your ownCloud instance to version 5.0.6 or later.

Who is affected by CVE-2013-2041?

Users of ownCloud versions 5.0.0 through 5.0.5 are affected by CVE-2013-2041.

What types of vulnerabilities are described in CVE-2013-2041?

CVE-2013-2041 describes multiple cross-site scripting (XSS) vulnerabilities.

What can attackers do with CVE-2013-2041?

Attackers can inject arbitrary web scripts or HTML via specific parameters, which could lead to data theft or session hijacking.