CVE-2012-4396 (GCVE-0-2012-4396)
Vulnerability from cvelistv5 – Published: 2012-09-05 23:00 – Updated: 2024-09-17 03:14
VLAI
EPSS
VEX
Summary
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/owncloud/core/commit/f8337c9d7… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/8f616ecf7… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/8f09299e2… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/e81750456… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2012/08/11/1 | mailing-listx_refsource_MLIST |
| https://github.com/owncloud/core/commit/d294373f4… | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2012/09/02/2 | mailing-listx_refsource_MLIST |
| https://github.com/owncloud/core/commit/642e7ce11… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/cc653a8a4… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/f955f6a68… | x_refsource_CONFIRM |
| https://github.com/owncloud/core/commit/44260a552… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:35:09.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48"
},
{
"name": "[oss-security] 20120810 ownCloud - matching CVEs to fix information and vice versa",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/11/1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606"
},
{
"name": "[oss-security] 20120901 Re: CVE - ownCloud",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/02/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-09-05T23:00:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48"
},
{
"name": "[oss-security] 20120810 ownCloud - matching CVEs to fix information and vice versa",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/11/1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606"
},
{
"name": "[oss-security] 20120901 Re: CVE - ownCloud",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/09/02/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2012-4396",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254"
},
{
"name": "https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438"
},
{
"name": "https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7"
},
{
"name": "https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48"
},
{
"name": "[oss-security] 20120810 ownCloud - matching CVEs to fix information and vice versa",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/08/11/1"
},
{
"name": "https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606"
},
{
"name": "[oss-security] 20120901 Re: CVE - ownCloud",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2012/09/02/2"
},
{
"name": "https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5"
},
{
"name": "https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c"
},
{
"name": "https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb"
},
{
"name": "https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027",
"refsource": "CONFIRM",
"url": "https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-4396",
"datePublished": "2012-09-05T23:00:00.000Z",
"dateReserved": "2012-08-21T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:14:34.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2012-4396",
"date": "2026-09-04",
"epss": "0.02485",
"percentile": "0.83517"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.0.1\", \"matchCriteriaId\": \"5C3FA1AD-BCD5-4DA7-BB06-24E6023EC33A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0A1021FF-2A5A-49AA-A376-09C98FECC519\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3F6C12F7-5897-4DBB-A9AB-8180101F37C3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:3.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E9CC055C-CFA3-4A23-AF91-83F7F087F282\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:3.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA5445B4-9115-4D31-9DF9-E7E30CAF1FFD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:owncloud:owncloud:4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8FAE7D90-6190-44E2-B4EA-F47FF3263BE6\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.\"}, {\"lang\": \"es\", \"value\": \"M\\u00faltiples vulnerabilidades de ejecuci\\u00f3n de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\\u00e9s de (1) nombre de ficheros para apps/user_ldap/settings.php; (2) url o (3) par\\u00e1metro t\\u00edtulo para apps/bookmarks/ajax/editBookmark.php; (4) etiqueta o (5) par\\u00e1metro page para apps/bookmarks/ajax/updateList.php; (6) identity para apps/user_openid/settings.php; (7) nombre stack en apps/gallery/lib/tiles.php; (8) par\\u00e1metro root para apps/gallery/templates/index.php; (9) calendar displayname en apps/calendar/templates/part.import.php; (10) calendar uri en apps/calendar/templates/part.choosecalendar.rowfields.php; (11) t\\u00edtulo, (12) localizaci\\u00f3n, o (13) par\\u00e1metro descripci\\u00f3n en apps/calendar/lib/object.php; (14) ciertos vectores en core/js/multiselect.js; o (15) artist, (16) album, o (17) title comments par\\u00e1metros en apps/media/lib_scanner.php.\"}]",
"id": "CVE-2012-4396",
"lastModified": "2024-11-21T01:42:47.957",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2012-09-05T23:55:03.053",
"references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2012/08/11/1\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/09/02/2\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/08/11/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2012/09/02/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}, {\"url\": \"https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Patch\"]}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2012-4396\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2012-09-05T23:55:03.053\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de (1) nombre de ficheros para apps/user_ldap/settings.php; (2) url o (3) par\u00e1metro t\u00edtulo para apps/bookmarks/ajax/editBookmark.php; (4) etiqueta o (5) par\u00e1metro page para apps/bookmarks/ajax/updateList.php; (6) identity para apps/user_openid/settings.php; (7) nombre stack en apps/gallery/lib/tiles.php; (8) par\u00e1metro root para apps/gallery/templates/index.php; (9) calendar displayname en apps/calendar/templates/part.import.php; (10) calendar uri en apps/calendar/templates/part.choosecalendar.rowfields.php; (11) t\u00edtulo, (12) localizaci\u00f3n, o (13) par\u00e1metro descripci\u00f3n en apps/calendar/lib/object.php; (14) ciertos vectores en core/js/multiselect.js; o (15) artist, (16) album, o (17) title comments par\u00e1metros en apps/media/lib_scanner.php.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.0.1\",\"matchCriteriaId\":\"5C3FA1AD-BCD5-4DA7-BB06-24E6023EC33A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud_server:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77DE37D0-74E5-4D66-8A2D-DA177936A4F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud_server:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB0E5BB3-900E-4D95-B302-4120567B6155\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud_server:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E1BB82C7-11E5-44E4-9029-76AE1F4AE937\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud_server:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40348D52-10C6-4436-84DC-4B63271AF180\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:owncloud:owncloud_server:4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D77D4260-0D48-47EE-A09B-FC200CB36A38\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2012/08/11/1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/09/02/2\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/08/11/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2012/09/02/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…