CVE-2021-35949

MEDIUM

ownCloud Server <10.8.0 - Auth Bypass

Title source: llm
STIX 2.1

Description

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://doc.owncloud.com/server/admin_manual/release_notes.html

Scores

CVSS v3 5.3
EPSS 0.0018
EPSS Percentile 38.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-863
Status published
Products (1)
owncloud/owncloud < 10.8.0
Published Sep 07, 2021
Tracked Since Feb 18, 2026