Description
Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
http://owncloud.org/about/security/advisories/oC-SA-2014-006/
Vendor Advisory x_refsource_confirm
https://owncloud.org/security/advisories/xxe-multiple-third-party-components/
Third Party Advisory, VDB Entry x_refsource_misc
https://www.securityfocus.com/bid/66222
Scores
CVSS v3
9.8
EPSS
0.0099
EPSS Percentile
77.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-611
Status
published
Products (2)
owncloud/owncloud
< 5.0.15
owncloud/owncloud_server
6.0.0 - 6.0.2
Published
Feb 11, 2020
Tracked Since
Feb 18, 2026