CVE-2014-2049: Medium severity ownCloud ownCloud vulnerability
Published Mar 14, 2014
·Updated
The default Flash Cross Domain policies in ownCloud before 5.0.15 and 6.x before 6.0.2 allows remote attackers to access user files via unspecified vectors.
Affected Software
103 affected components
ownCloud ownCloud=6.0.0
ownCloud ownCloud=6.0.1
ownCloud ownCloud<=5.0.14
ownCloud ownCloud=3.0.0
ownCloud ownCloud=3.0.1
ownCloud ownCloud=3.0.2
ownCloud ownCloud=3.0.3
ownCloud ownCloud=4.0.0
ownCloud ownCloud=4.0.1
ownCloud ownCloud=4.0.2
ownCloud ownCloud=4.0.3
ownCloud ownCloud=4.0.4
ownCloud ownCloud=4.0.5
ownCloud ownCloud=4.0.6
ownCloud ownCloud=4.0.7
ownCloud ownCloud=4.0.8
ownCloud ownCloud=4.0.9
ownCloud ownCloud=4.0.10
ownCloud ownCloud=4.0.11
ownCloud ownCloud=4.0.12
ownCloud ownCloud=4.0.13
ownCloud ownCloud=4.0.14
ownCloud ownCloud=4.0.15
ownCloud ownCloud=4.0.16
ownCloud ownCloud=4.5.0
ownCloud ownCloud=4.5.1
ownCloud ownCloud=4.5.2
ownCloud ownCloud=4.5.3
ownCloud ownCloud=4.5.4
ownCloud ownCloud=4.5.5
ownCloud ownCloud=4.5.6
ownCloud ownCloud=4.5.7
ownCloud ownCloud=4.5.8
ownCloud ownCloud=4.5.9
ownCloud ownCloud=4.5.10
ownCloud ownCloud=4.5.11
ownCloud ownCloud=4.5.12
ownCloud ownCloud=4.5.13
ownCloud ownCloud=5.0.0
ownCloud ownCloud=5.0.1
ownCloud ownCloud=5.0.2
ownCloud ownCloud=5.0.3
ownCloud ownCloud=5.0.4
ownCloud ownCloud=5.0.5
ownCloud ownCloud=5.0.6
ownCloud ownCloud=5.0.7
ownCloud ownCloud=5.0.8
ownCloud ownCloud=5.0.9
ownCloud ownCloud=5.0.10
ownCloud ownCloud=5.0.11
ownCloud ownCloud=5.0.12
ownCloud ownCloud=5.0.13
ownCloud ownCloud Server=6.0.0
ownCloud ownCloud Server=6.0.1
ownCloud ownCloud Server=3.0.0
ownCloud ownCloud Server=3.0.1
ownCloud ownCloud Server=3.0.2
ownCloud ownCloud Server=3.0.3
ownCloud ownCloud Server=4.0.0
ownCloud ownCloud Server=4.0.1
ownCloud ownCloud Server=4.0.2
ownCloud ownCloud Server=4.0.3
ownCloud ownCloud Server=4.0.4
ownCloud ownCloud Server=4.0.5
ownCloud ownCloud Server=4.0.6
ownCloud ownCloud Server=4.0.7
ownCloud ownCloud Server=4.0.8
ownCloud ownCloud Server=4.0.9
ownCloud ownCloud Server=4.0.10
ownCloud ownCloud Server=4.0.11
ownCloud ownCloud Server=4.0.12
ownCloud ownCloud Server=4.0.13
ownCloud ownCloud Server=4.0.14
ownCloud ownCloud Server=4.0.15
ownCloud ownCloud Server=4.0.16
ownCloud ownCloud Server=4.5.0
ownCloud ownCloud Server=4.5.1
ownCloud ownCloud Server=4.5.2
ownCloud ownCloud Server=4.5.3
ownCloud ownCloud Server=4.5.4
ownCloud ownCloud Server=4.5.5
ownCloud ownCloud Server=4.5.6
ownCloud ownCloud Server=4.5.7
ownCloud ownCloud Server=4.5.8
ownCloud ownCloud Server=4.5.9
ownCloud ownCloud Server=4.5.10
ownCloud ownCloud Server=4.5.11
ownCloud ownCloud Server=4.5.12
ownCloud ownCloud Server=4.5.13
ownCloud ownCloud Server=5.0.0
ownCloud ownCloud Server=5.0.1
ownCloud ownCloud Server=5.0.2
ownCloud ownCloud Server=5.0.3
ownCloud ownCloud Server=5.0.4
ownCloud ownCloud Server=5.0.5
ownCloud ownCloud Server=5.0.6
ownCloud ownCloud Server=5.0.7
ownCloud ownCloud Server=5.0.8
ownCloud ownCloud Server=5.0.9
ownCloud ownCloud Server=5.0.10
ownCloud ownCloud Server=5.0.11
ownCloud ownCloud Server=5.0.12
ownCloud ownCloud Server=5.0.13
Remediation
Event History
Mar 14, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2049?
CVE-2014-2049 is classified as a medium severity vulnerability due to the potential unauthorized access to user files.
2
How do I fix CVE-2014-2049?
To fix CVE-2014-2049, upgrade ownCloud to version 5.0.15 or later, or to 6.0.2 or later.
3
Who is affected by CVE-2014-2049?
CVE-2014-2049 affects ownCloud versions prior to 5.0.15 and 6.x prior to 6.0.2.
4
What types of attacks can exploit CVE-2014-2049?
CVE-2014-2049 can be exploited by attackers to gain unauthorized access to user files through default Flash Cross Domain policies.
5
What is ownCloud's recommended action regarding CVE-2014-2049?
ownCloud recommends that users immediately update their installations to mitigate the CVE-2014-2049 vulnerability.