CVE-2021-44537
HIGHowncloud_desktop_client < 2.9.2 - Remote Code Execution via URL Resource Injection
Title source: llmDescription
ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
https://owncloud.com/security-advisories/cve-2021-44537/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSZNJFGM66LJONBQFYYQL4GD5XI5QO2Y/
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STKTSNYBZPXBGJOCDAMCZPRXJLAYGDMO/
Scores
CVSS v3
7.8
EPSS
0.0109
EPSS Percentile
78.2%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-74
Status
published
Products (3)
fedoraproject/fedora
35
fedoraproject/fedora
36
owncloud/owncloud_desktop_client
< 2.9.2
Published
Jan 15, 2022
Tracked Since
Feb 18, 2026