CVE-2013-2047: Low severity ownCloud ownCloud vulnerability

Q: What is the severity of CVE-2013-2047?

CVE-2013-2047 is classified as a medium severity vulnerability due to the risk of password disclosure to physically proximate attackers.

Q: How do I fix CVE-2013-2047?

To fix CVE-2013-2047, upgrade to ownCloud version 5.0.6 or later, which disables autocomplete for the password field.

Q: Which versions of ownCloud are affected by CVE-2013-2047?

CVE-2013-2047 affects ownCloud versions before 5.0.6, including versions 5.0.0 to 5.0.5.

Q: What type of attack does CVE-2013-2047 expose users to?

CVE-2013-2047 exposes users to potential password guessing attacks by allowing password autocomplete on the login page.

Q: Is CVE-2013-2047 a remote or local vulnerability?

CVE-2013-2047 is considered a local vulnerability since it requires physical proximity to the target system to exploit.

Published Mar 14, 2014

Updated

The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it easier for physically proximate attackers to guess the password.

Affected Software

11 affected components

ownCloud ownCloud<=5.0.5

ownCloud ownCloud=5.0.0

ownCloud ownCloud=5.0.1

ownCloud ownCloud=5.0.2

ownCloud ownCloud=5.0.3

ownCloud ownCloud=5.0.4

ownCloud ownCloud Server=5.0.0

ownCloud ownCloud Server=5.0.1

ownCloud ownCloud Server=5.0.2

ownCloud ownCloud Server=5.0.3

ownCloud ownCloud Server=5.0.4

Remediation

Patch Available

http://owncloud.org/about/security/advisories/oC-SA-2013-023/

Event History

Mar 14, 2014

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:55 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-2047?

CVE-2013-2047 is classified as a medium severity vulnerability due to the risk of password disclosure to physically proximate attackers.

How do I fix CVE-2013-2047?