CVE-2015-4715

Name of the Vulnerable Software and Affected Versions: ownCloud Server versions prior to 6.0.8 ownCloud Server versions 7.x prior to 7.0.6 ownCloud Server versions 8.x prior to 8.0.4

Description: The issue allows remote administrators of Dropbox.com to read arbitrary files. This is possible due to the fetch function in OAuth/Curl.php when an external Dropbox storage has been mounted. The exploitation involves an @ (at sign) character in unspecified POST values.

Recommendations: For ownCloud Server versions prior to 6.0.8, update to version 6.0.8 or later. For ownCloud Server versions 7.x prior to 7.0.6, update to version 7.0.6 or later. For ownCloud Server versions 8.x prior to 8.0.4, update to version 8.0.4 or later.