CVE-2013-2089

published 2014-03-14

CVE-2013-2089: Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then…

Priority P4 26 medium 4.6 CVSS 2.0

AV N AC H Au S C P I P A P

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
owncloud	owncloud	<= 5.0.5	—
owncloud	owncloud	>= 0 < 6.0.1+dfsg-1ubuntu1	6.0.1+dfsg-1ubuntu1
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—
owncloud	owncloud_server	—	—

CVSS provenance

nvd v2.0 4.6 MEDIUM AV:N/AC:H/Au:S/C:P/I:P/A:P

osv 4.6 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.