CVE-2014-2585: Input Validation
ownCloud before 5.0.15 and 6.x before 6.0.2, when the fileexternal app is enabled, allows remote authenticated users to mount the local filesystem in the user's ownCloud via the mount configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ownCloudto a version that resolves this vulnerability.Fixed in 5.0.15 - Upgrade
Upgrade
ownCloudto a version that resolves this vulnerability.Fixed in 6.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2585?
CVE-2014-2585 has a severity rating that emphasizes the risk of remote authenticated users mounting the local filesystem.
How do I fix CVE-2014-2585?
To fix CVE-2014-2585, upgrade to ownCloud version 5.0.15 or higher and 6.0.2 or higher.
Which versions are affected by CVE-2014-2585?
CVE-2014-2585 affects ownCloud versions before 5.0.15 and 6.x before 6.0.2 with the file_external app enabled.
What can remote authenticated users do if CVE-2014-2585 is not patched?
If CVE-2014-2585 is not patched, remote authenticated users can mount the local filesystem in their ownCloud account.
Is the file_external app necessary for CVE-2014-2585 to be exploitable?
Yes, the file_external app must be enabled for CVE-2014-2585 to be exploitable.