CVE-2013-1850 — Code Injection in Owncloud

CWE-94 — Code Injection3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 34.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OwncloudOwncloud Server
Timeline
PublishedMar 14
Latest updateMay 17

Description

Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages2 packages

▶NVDowncloud/owncloud4.0.12
▶NVDowncloud/owncloud_server24 versions+23

🔴Vulnerability Details

2
GHSA
GHSA-hm7v-p5f8-cv9h: Multiple incomplete blacklist vulnerabilities in (1) import↗2022-05-17
▶
CVEList
CVE-2013-1850: Multiple incomplete blacklist vulnerabilities in (1) import↗2014-03-14
▶
CVE-2013-1850 — Code Injection in Owncloud | cvebase