CVE-2020-28645: Input Validation
Published Feb 9, 2021
·Updated
Deleting users with certain names caused system files to be deleted. Risk is higher for systems which allow users to register themselves and have the data directory in the web root. This affects ownCloud/core versions < 10.6.
Affected Software
1 affected component
ownCloud ownCloud<10.6.0
Event History
Feb 9, 2021
CVE Published
via MITRE·06:41 PM
Data Sourced
via MITRE·06:41 PM
Description
Frequently Asked Questions
1
What is CVE-2020-28645?
CVE-2020-28645 is a vulnerability that allows for the deletion of system files when deleting users with certain names.
2
What is the risk associated with CVE-2020-28645?
The risk is higher for systems that allow users to register themselves and have the data directory in the web root.
3
Which versions of ownCloud/core are affected by CVE-2020-28645?
ownCloud/core versions < 10.6 are affected by CVE-2020-28645.
4
How severe is CVE-2020-28645?
CVE-2020-28645 has a severity rating of 9.1 (critical).
5
How can CVE-2020-28645 be fixed?
To fix CVE-2020-28645, update ownCloud/core to a version higher than 10.6.0.