CVE-2016-1500: Infoleak
ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "fileversions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1500?
CVE-2016-1500 has a medium severity rating due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2016-1500?
The fix for CVE-2016-1500 involves upgrading ownCloud to a version later than 7.0.12, 8.0.10, 8.1.5, or 8.2.2.
Who is affected by CVE-2016-1500?
Users of ownCloud Server versions prior to the specified patched versions with the 'file_versions' application enabled are affected by CVE-2016-1500.
What type of vulnerability is CVE-2016-1500?
CVE-2016-1500 is a security vulnerability that allows remote authenticated users to read hidden files in ownCloud.
Can CVE-2016-1500 be exploited remotely?
Yes, CVE-2016-1500 can be exploited by remote authenticated users to access restricted files.