CVE-2021-35948
MEDIUMownCloud Server <10.8.0 - Auth Bypass
Title source: llmDescription
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.
Scores
CVSS v3
5.4
EPSS
0.0017
EPSS Percentile
38.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Classification
CWE
CWE-384
Status
published
Affected Products (1)
owncloud/owncloud
< 10.8.0
Timeline
Published
Sep 07, 2021
Tracked Since
Feb 18, 2026