PT-2019-6838
CVE-2013-0203
·
تاريخ النشر
2019-11-22
·
تاريخ التحديث
2019-12-02
الوصف من
CVSS 2.0
3.5
منخفضةالمقاييسAV:N/AC:M/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions
ownCloud versions 4.0.10 through 4.5.5
ownCloud versions prior to 4.0.10
Description
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the unspecified parameters to "apps/calendar/ajax/event/new.php" or the
url parameter to "apps/bookmarks/ajax/addBookmark.php".Recommendations
For ownCloud versions 4.0.10 through 4.5.5, consider disabling access to the "apps/calendar/ajax/event/new.php" and "apps/bookmarks/ajax/addBookmark.php" API endpoints until a fix is available.
For ownCloud versions prior to 4.0.10, restrict the use of unspecified parameters in "apps/calendar/ajax/event/new.php" and the
url parameter in "apps/bookmarks/ajax/addBookmark.php" to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾