CVE-2013-2041: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via…

PriorityP412low3.5CVSS 2.0

AVNACMAuSCNIPAN

EPSS

1.15%

63.0th percentile

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tag parameter to apps/bookmarks/ajax/addBookmark.php or (2) dir parameter to apps/files/ajax/newfile.php, which is passed to apps/files/js/files.js.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
owncloud	owncloud	>= 0 < 6.0.1+dfsg-1ubuntu1	6.0.1+dfsg-1ubuntu1
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—

CVSS provenance

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

osv3.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.