CVE-2014-2057: XSS
Published Mar 23, 2014
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 6.0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
105 affected components
ownCloud ownCloud<=6.0.1
ownCloud ownCloud=3.0.0
ownCloud ownCloud=3.0.1
ownCloud ownCloud=3.0.2
ownCloud ownCloud=3.0.3
ownCloud ownCloud=4.0.0
ownCloud ownCloud=4.0.1
ownCloud ownCloud=4.0.2
ownCloud ownCloud=4.0.3
ownCloud ownCloud=4.0.4
ownCloud ownCloud=4.0.5
ownCloud ownCloud=4.0.6
ownCloud ownCloud=4.0.7
ownCloud ownCloud=4.0.8
ownCloud ownCloud=4.0.9
ownCloud ownCloud=4.0.10
ownCloud ownCloud=4.0.11
ownCloud ownCloud=4.0.12
ownCloud ownCloud=4.0.13
ownCloud ownCloud=4.0.14
ownCloud ownCloud=4.0.15
ownCloud ownCloud=4.0.16
ownCloud ownCloud=4.5.0
ownCloud ownCloud=4.5.1
ownCloud ownCloud=4.5.2
ownCloud ownCloud=4.5.3
ownCloud ownCloud=4.5.4
ownCloud ownCloud=4.5.5
ownCloud ownCloud=4.5.6
ownCloud ownCloud=4.5.7
ownCloud ownCloud=4.5.8
ownCloud ownCloud=4.5.9
ownCloud ownCloud=4.5.10
ownCloud ownCloud=4.5.11
ownCloud ownCloud=4.5.12
ownCloud ownCloud=4.5.13
ownCloud ownCloud=5.0.0
ownCloud ownCloud=5.0.1
ownCloud ownCloud=5.0.2
ownCloud ownCloud=5.0.3
ownCloud ownCloud=5.0.4
ownCloud ownCloud=5.0.5
ownCloud ownCloud=5.0.6
ownCloud ownCloud=5.0.7
ownCloud ownCloud=5.0.8
ownCloud ownCloud=5.0.9
ownCloud ownCloud=5.0.10
ownCloud ownCloud=5.0.11
ownCloud ownCloud=5.0.12
ownCloud ownCloud=5.0.13
ownCloud ownCloud=5.0.14
ownCloud ownCloud=5.0.14-a
ownCloud ownCloud=6.0.0
ownCloud ownCloud Server=3.0.0
ownCloud ownCloud Server=3.0.1
ownCloud ownCloud Server=3.0.2
ownCloud ownCloud Server=3.0.3
ownCloud ownCloud Server=4.0.0
ownCloud ownCloud Server=4.0.1
ownCloud ownCloud Server=4.0.2
ownCloud ownCloud Server=4.0.3
ownCloud ownCloud Server=4.0.4
ownCloud ownCloud Server=4.0.5
ownCloud ownCloud Server=4.0.6
ownCloud ownCloud Server=4.0.7
ownCloud ownCloud Server=4.0.8
ownCloud ownCloud Server=4.0.9
ownCloud ownCloud Server=4.0.10
ownCloud ownCloud Server=4.0.11
ownCloud ownCloud Server=4.0.12
ownCloud ownCloud Server=4.0.13
ownCloud ownCloud Server=4.0.14
ownCloud ownCloud Server=4.0.15
ownCloud ownCloud Server=4.0.16
ownCloud ownCloud Server=4.5.0
ownCloud ownCloud Server=4.5.1
ownCloud ownCloud Server=4.5.2
ownCloud ownCloud Server=4.5.3
ownCloud ownCloud Server=4.5.4
ownCloud ownCloud Server=4.5.5
ownCloud ownCloud Server=4.5.6
ownCloud ownCloud Server=4.5.7
ownCloud ownCloud Server=4.5.8
ownCloud ownCloud Server=4.5.9
ownCloud ownCloud Server=4.5.10
ownCloud ownCloud Server=4.5.11
ownCloud ownCloud Server=4.5.12
ownCloud ownCloud Server=4.5.13
ownCloud ownCloud Server=5.0.0
ownCloud ownCloud Server=5.0.1
ownCloud ownCloud Server=5.0.2
ownCloud ownCloud Server=5.0.3
ownCloud ownCloud Server=5.0.4
ownCloud ownCloud Server=5.0.5
ownCloud ownCloud Server=5.0.6
ownCloud ownCloud Server=5.0.7
ownCloud ownCloud Server=5.0.8
ownCloud ownCloud Server=5.0.9
ownCloud ownCloud Server=5.0.10
ownCloud ownCloud Server=5.0.11
ownCloud ownCloud Server=5.0.12
ownCloud ownCloud Server=5.0.13
ownCloud ownCloud Server=5.0.14
ownCloud ownCloud Server=5.0.14-a
ownCloud ownCloud Server=6.0.0
Event History
Mar 23, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Mar 24, 2014
Data Sourced
via NVD·04:31 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2057?
CVE-2014-2057 is classified as a medium severity vulnerability due to its ability to allow remote attackers to inject arbitrary web scripts or HTML.
2
How do I fix CVE-2014-2057?
To fix CVE-2014-2057, you should upgrade to ownCloud version 6.0.2 or later, as this version includes the necessary security patches.
3
What types of vulnerabilities does CVE-2014-2057 involve?
CVE-2014-2057 involves multiple cross-site scripting (XSS) vulnerabilities.
4
Which versions of ownCloud are affected by CVE-2014-2057?
CVE-2014-2057 affects versions of ownCloud prior to 6.0.2, including versions 3.0.0 to 6.0.1.
5
Can CVE-2014-2057 be exploited by unauthenticated users?
Yes, CVE-2014-2057 can be exploited by unauthenticated users who can inject malicious scripts into the web application.