CVE-2012-5606

ownCloud < 4.0.9 - Cross-Site Scripting via File Name or Event Title

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.9 and 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) file name to apps/files_versions/js/versions.js or (2) apps/files/js/filelist.js; or (3) event title to 3rdparty/fullcalendar/js/fullcalendar.js.

References (7)

Core 7
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51357
Patch, Vendor Advisory x_refsource_confirm
http://owncloud.org/security/advisories/oc-sa-2012-001/
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/11/30/3
Various Sources x_refsource_confirm
http://owncloud.org/changelog/

Scores

EPSS 0.0052
EPSS Percentile 67.0%

Details

CWE
CWE-79
Status published
Products (14)
owncloud/owncloud < 4.0.8
owncloud/owncloud_server 3.0.0
owncloud/owncloud_server 3.0.1
owncloud/owncloud_server 3.0.2
owncloud/owncloud_server 3.0.3
owncloud/owncloud_server 4.0.0
owncloud/owncloud_server 4.0.1
owncloud/owncloud_server 4.0.2
owncloud/owncloud_server 4.0.3
owncloud/owncloud_server 4.0.4
... and 4 more
Published Dec 18, 2012
Tracked Since Feb 18, 2026