CVE-2013-0203

Name of the Vulnerable Software and Affected Versions ownCloud versions 4.0.10 through 4.5.5 ownCloud versions prior to 4.0.10

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the unspecified parameters to "apps/calendar/ajax/event/new.php" or the url parameter to "apps/bookmarks/ajax/addBookmark.php".

Recommendations For ownCloud versions 4.0.10 through 4.5.5, consider disabling access to the "apps/calendar/ajax/event/new.php" and "apps/bookmarks/ajax/addBookmark.php" API endpoints until a fix is available. For ownCloud versions prior to 4.0.10, restrict the use of unspecified parameters in "apps/calendar/ajax/event/new.php" and the url parameter in "apps/bookmarks/ajax/addBookmark.php" to minimize the risk of exploitation.