CVE-2015-4718: OS Command Injection
Published Oct 21, 2015
·Updated
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
Affected Software
19 affected components
ownCloud ownCloud<=6.0.7
ownCloud ownCloud=7.0.0
ownCloud ownCloud=7.0.1
ownCloud ownCloud=7.0.2
ownCloud ownCloud=7.0.3
ownCloud ownCloud=7.0.4
ownCloud ownCloud=7.0.5
ownCloud ownCloud=8.0.0
ownCloud ownCloud=8.0.2
ownCloud ownCloud=8.0.3
ownCloud ownCloud Server=7.0.0
ownCloud ownCloud Server=7.0.1
ownCloud ownCloud Server=7.0.2
ownCloud ownCloud Server=7.0.3
ownCloud ownCloud Server=7.0.4
ownCloud ownCloud Server=7.0.5
ownCloud ownCloud Server=8.0.0
ownCloud ownCloud Server=8.0.2
ownCloud ownCloud Server=8.0.3
Event History
Oct 21, 2015
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-4718?
CVE-2015-4718 has a medium severity level, allowing remote authenticated users to execute arbitrary SMB commands.
2
How do I fix CVE-2015-4718?
To fix CVE-2015-4718, update your ownCloud server to versions 6.0.8, 7.0.6, or 8.0.4 or later.
3
What versions of ownCloud are affected by CVE-2015-4718?
CVE-2015-4718 affects ownCloud versions prior to 6.0.8, 7.0.6, and 8.0.4.
4
Can CVE-2015-4718 be exploited remotely?
Yes, CVE-2015-4718 can be exploited remotely by authenticated users.
5
What type of vulnerability is CVE-2015-4718?
CVE-2015-4718 is a command injection vulnerability in the external SMB storage driver.