CVE-2014-9042: XSS
First published: Wed Feb 04 2015(Updated: )
Cross-site scripting (XSS) vulnerability in the import functionality in the bookmarks application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote authenticated users to inject arbitrary web script or HTML by importing a link with an unspecified protocol. NOTE: this can be leveraged by remote attackers using CVE-2014-9041.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ownCloud | <=5.0.17 | |
| ownCloud | =5.0.0 | |
| ownCloud | =5.0.1 | |
| ownCloud | =5.0.2 | |
| ownCloud | =5.0.3 | |
| ownCloud | =5.0.4 | |
| ownCloud | =5.0.5 | |
| ownCloud | =5.0.6 | |
| ownCloud | =5.0.7 | |
| ownCloud | =5.0.8 | |
| ownCloud | =5.0.9 | |
| ownCloud | =5.0.10 | |
| ownCloud | =5.0.11 | |
| ownCloud | =5.0.12 | |
| ownCloud | =5.0.13 | |
| ownCloud | =5.0.14 | |
| ownCloud | =5.0.14-a | |
| ownCloud | =5.0.15 | |
| ownCloud | =5.0.16 | |
| ownCloud | =6.0.0 | |
| ownCloud | =6.0.1 | |
| ownCloud | =6.0.2 | |
| ownCloud | =6.0.3 | |
| ownCloud | =6.0.4 | |
| ownCloud | =6.0.5 | |
| ownCloud | =7.0.0 | |
| ownCloud | =7.0.1 | |
| ownCloud | =7.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-9042?
CVE-2014-9042 has a medium severity due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2014-9042?
To fix CVE-2014-9042, upgrade ownCloud to version 5.0.18, 6.0.6, or 7.0.3 or later.
Which versions of ownCloud are affected by CVE-2014-9042?
CVE-2014-9042 affects ownCloud versions before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3.
What type of vulnerability is CVE-2014-9042?
CVE-2014-9042 is a cross-site scripting (XSS) vulnerability.
Who can exploit CVE-2014-9042?
CVE-2014-9042 can be exploited by remote authenticated users.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/owncloud
- canonical/owncloud
- version/owncloud/5.0.17
- version/owncloud/5.0.0
- version/owncloud/5.0.1
- version/owncloud/5.0.2
- version/owncloud/5.0.3
- version/owncloud/5.0.4
- version/owncloud/5.0.5
- version/owncloud/5.0.6
- version/owncloud/5.0.7
- version/owncloud/5.0.8
- version/owncloud/5.0.9
- version/owncloud/5.0.10
- version/owncloud/5.0.11
- version/owncloud/5.0.12
- version/owncloud/5.0.13
- version/owncloud/5.0.14
- version/owncloud/5.0.14-a
- version/owncloud/5.0.15
- version/owncloud/5.0.16
- version/owncloud/6.0.0
- version/owncloud/6.0.1
- version/owncloud/6.0.2
- version/owncloud/6.0.3
- version/owncloud/6.0.4
- version/owncloud/6.0.5
- version/owncloud/7.0.0
- version/owncloud/7.0.1
- version/owncloud/7.0.2