CVE-2015-5953: XSS
Published Oct 21, 2015
·Updated
Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " (double quote) character in a filename in a shared folder.
Affected Software
7 affected components
ownCloud ownCloud<=7.0.4
ownCloud ownCloud=8.0.0
ownCloud ownCloud=8.0.2
ownCloud ownCloud=8.0.3
ownCloud ownCloud Server=8.0.0
ownCloud ownCloud Server=8.0.2
ownCloud ownCloud Server=8.0.3
Event History
Oct 21, 2015
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
via NVD·03:59 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-5953?
CVE-2015-5953 has a Medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2015-5953?
To fix CVE-2015-5953, upgrade to ownCloud Server version 7.0.5 or 8.0.4 or later.
3
Who is affected by CVE-2015-5953?
CVE-2015-5953 affects remote authenticated users of ownCloud Server versions prior to 7.0.5 and 8.0.x before 8.0.4.
4
What type of vulnerability is CVE-2015-5953?
CVE-2015-5953 is classified as a cross-site scripting (XSS) vulnerability.
5
What can an attacker do with CVE-2015-5953?
An attacker can exploit CVE-2015-5953 to inject arbitrary web scripts or HTML into shared folders.