CVE-2014-9041: CSRF
Published Feb 4, 2015
·Updated
The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks.
Affected Software
55 affected components
ownCloud ownCloud<=5.0.17
ownCloud ownCloud=5.0.0
ownCloud ownCloud=5.0.1
ownCloud ownCloud=5.0.2
ownCloud ownCloud=5.0.3
ownCloud ownCloud=5.0.4
ownCloud ownCloud=5.0.5
ownCloud ownCloud=5.0.6
ownCloud ownCloud=5.0.7
ownCloud ownCloud=5.0.8
ownCloud ownCloud=5.0.9
ownCloud ownCloud=5.0.10
ownCloud ownCloud=5.0.11
ownCloud ownCloud=5.0.12
ownCloud ownCloud=5.0.13
ownCloud ownCloud=5.0.14
ownCloud ownCloud=5.0.14-a
ownCloud ownCloud=5.0.15
ownCloud ownCloud=5.0.16
ownCloud ownCloud=6.0.0
ownCloud ownCloud=6.0.1
ownCloud ownCloud=6.0.2
ownCloud ownCloud=6.0.3
ownCloud ownCloud=6.0.4
ownCloud ownCloud=6.0.5
ownCloud ownCloud=7.0.0
ownCloud ownCloud=7.0.1
ownCloud ownCloud=7.0.2
ownCloud ownCloud Server=5.0.0
ownCloud ownCloud Server=5.0.1
ownCloud ownCloud Server=5.0.2
ownCloud ownCloud Server=5.0.3
ownCloud ownCloud Server=5.0.4
ownCloud ownCloud Server=5.0.5
ownCloud ownCloud Server=5.0.6
ownCloud ownCloud Server=5.0.7
ownCloud ownCloud Server=5.0.8
ownCloud ownCloud Server=5.0.9
ownCloud ownCloud Server=5.0.10
ownCloud ownCloud Server=5.0.11
ownCloud ownCloud Server=5.0.12
ownCloud ownCloud Server=5.0.13
ownCloud ownCloud Server=5.0.14
ownCloud ownCloud Server=5.0.14-a
ownCloud ownCloud Server=5.0.15
ownCloud ownCloud Server=5.0.16
ownCloud ownCloud Server=6.0.0
ownCloud ownCloud Server=6.0.1
ownCloud ownCloud Server=6.0.2
ownCloud ownCloud Server=6.0.3
ownCloud ownCloud Server=6.0.4
ownCloud ownCloud Server=6.0.5
ownCloud ownCloud Server=7.0.0
ownCloud ownCloud Server=7.0.1
ownCloud ownCloud Server=7.0.2
Event History
Feb 4, 2015
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-9041?
CVE-2014-9041 has a medium severity level due to the potential for Cross-Site Request Forgery (CSRF) attacks.
2
How do I fix CVE-2014-9041?
To fix CVE-2014-9041, upgrade your ownCloud server to version 5.0.18, 6.0.6, or 7.0.3 or later.
3
What versions of ownCloud are affected by CVE-2014-9041?
CVE-2014-9041 affects ownCloud server versions earlier than 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3.
4
What type of vulnerability is CVE-2014-9041?
CVE-2014-9041 is a Cross-Site Request Forgery (CSRF) vulnerability.
5
Who can exploit CVE-2014-9041?
Remote attackers can exploit CVE-2014-9041 to conduct CSRF attacks against users of the affected ownCloud versions.