CVE-2013-2048

published 2014-03-14

CVE-2013-2048: ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors…

Priority P3 41 medium 6.5 CVSS 2.0

AV N AC L Au S C P I P A P

ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
owncloud	owncloud	<= 5.0.5	—
owncloud	owncloud	>= 0 < 6.0.1+dfsg-1ubuntu1	6.0.1+dfsg-1ubuntu1
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—

CVSS provenance

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

osv 6.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264