CVE-2020-28644: CSRF
Published Feb 9, 2021
·Updated
The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownCloud/core version < 10.6.
Affected Software
1 affected component
ownCloud ownCloud<10.6.0
Event History
Feb 9, 2021
CVE Published
via MITRE·06:18 PM
Data Sourced
via MITRE·06:18 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-28644.
2
What is the severity of CVE-2020-28644?
The severity of CVE-2020-28644 is medium.
3
What is CSRF and how does it affect this vulnerability?
CSRF stands for Cross-Site Request Forgery and it affects this vulnerability because the CSRF token check was improperly implemented on cookie authenticated requests against some ownCloud API endpoints.
4
Which versions of ownCloud/core are affected by CVE-2020-28644?
ownCloud/core version less than 10.6 is affected by CVE-2020-28644.
5
How can I fix the CSRF token check vulnerability in ownCloud?
To fix the CSRF token check vulnerability in ownCloud, it is recommended to update to version 10.6 or later.