Description
Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.
Scores
CVSS v3
5.4
EPSS
0.0017
EPSS Percentile
38.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Details
CWE
CWE-384
Status
published
Products (1)
owncloud/owncloud
< 10.8.0
Published
Sep 07, 2021
Tracked Since
Feb 18, 2026