CVE-2014-9043: Medium severity owncloud vulnerability
Published Feb 4, 2015
·Updated
The userldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
Affected Software
55 affected components
ownCloud ownCloud<=5.0.17
ownCloud ownCloud=5.0.0
ownCloud ownCloud=5.0.1
ownCloud ownCloud=5.0.2
ownCloud ownCloud=5.0.3
ownCloud ownCloud=5.0.4
ownCloud ownCloud=5.0.5
ownCloud ownCloud=5.0.6
ownCloud ownCloud=5.0.7
ownCloud ownCloud=5.0.8
ownCloud ownCloud=5.0.9
ownCloud ownCloud=5.0.10
ownCloud ownCloud=5.0.11
ownCloud ownCloud=5.0.12
ownCloud ownCloud=5.0.13
ownCloud ownCloud=5.0.14
ownCloud ownCloud=5.0.14-a
ownCloud ownCloud=5.0.15
ownCloud ownCloud=5.0.16
ownCloud ownCloud=6.0.0
ownCloud ownCloud=6.0.1
ownCloud ownCloud=6.0.2
ownCloud ownCloud=6.0.3
ownCloud ownCloud=6.0.4
ownCloud ownCloud=6.0.5
ownCloud ownCloud=7.0.0
ownCloud ownCloud=7.0.1
ownCloud ownCloud=7.0.2
ownCloud ownCloud Server=5.0.0
ownCloud ownCloud Server=5.0.1
ownCloud ownCloud Server=5.0.2
ownCloud ownCloud Server=5.0.3
ownCloud ownCloud Server=5.0.4
ownCloud ownCloud Server=5.0.5
ownCloud ownCloud Server=5.0.6
ownCloud ownCloud Server=5.0.7
ownCloud ownCloud Server=5.0.8
ownCloud ownCloud Server=5.0.9
ownCloud ownCloud Server=5.0.10
ownCloud ownCloud Server=5.0.11
ownCloud ownCloud Server=5.0.12
ownCloud ownCloud Server=5.0.13
ownCloud ownCloud Server=5.0.14
ownCloud ownCloud Server=5.0.14-a
ownCloud ownCloud Server=5.0.15
ownCloud ownCloud Server=5.0.16
ownCloud ownCloud Server=6.0.0
ownCloud ownCloud Server=6.0.1
ownCloud ownCloud Server=6.0.2
ownCloud ownCloud Server=6.0.3
ownCloud ownCloud Server=6.0.4
ownCloud ownCloud Server=6.0.5
ownCloud ownCloud Server=7.0.0
ownCloud ownCloud Server=7.0.1
ownCloud ownCloud Server=7.0.2
Event History
Feb 4, 2015
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-9043?
CVE-2014-9043 is considered a critical vulnerability that allows unauthorized access to user accounts.
2
How do I fix CVE-2014-9043?
To address CVE-2014-9043, upgrade to ownCloud version 5.0.18, 6.0.6, or 7.0.3 or later.
3
Which versions of ownCloud are affected by CVE-2014-9043?
CVE-2014-9043 affects ownCloud versions prior to 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3.
4
What kind of attack does CVE-2014-9043 allow?
CVE-2014-9043 allows remote attackers to bypass authentication using a null byte in the password.
5
Is CVE-2014-9043 related to LDAP configurations in ownCloud?
Yes, CVE-2014-9043 specifically affects the user_ldap application in ownCloud.