CVE-2013-2048

ownCloud < 5.0.6 - Authenticated Arbitrary API Command Execution

Title source: llm
STIX 2.1

Description

ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via unspecified vectors. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary API commands.

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
http://owncloud.org/about/security/advisories/oC-SA-2013-025/

Scores

EPSS 0.0030
EPSS Percentile 53.1%

Details

CWE
CWE-264
Status published
Products (6)
owncloud/owncloud < 5.0.5
owncloud/owncloud_server 5.0.0
owncloud/owncloud_server 5.0.1
owncloud/owncloud_server 5.0.2
owncloud/owncloud_server 5.0.3
owncloud/owncloud_server 5.0.4
Published Mar 14, 2014
Tracked Since Feb 18, 2026