CVE-2014-3834 — Unsafe Reflection in Owncloud

CWE-264CWE-470 — Unsafe Reflection5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 46.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OwncloudOwncloud Server
Timeline
PublishedJun 4
Latest updateMay 17

Description

ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDowncloud/owncloud_server6.0.0, 6.0.1+1

🔴Vulnerability Details

2
GHSA
GHSA-9wwm-rhcq-vg49: ownCloud Server before 6↗2022-05-17
▶
CVEList
CVE-2014-3834: ownCloud Server before 6↗2014-06-04
▶

📋Vendor Advisories

1
Red Hat
JON: struts1 reversion of fix for CVE-2014-0114↗2019-10-02
▶

💬Community

1
Bugzilla
CVE-2019-3834 JON: struts1 reversion of fix for CVE-2014-0114↗2019-02-15
▶
CVE-2014-3834 — Unsafe Reflection in Owncloud | cvebase