The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Owncloud | Owncloud | 5.0.0 | 5.0.0 |
| Owncloud | Owncloud | 5.0.1 | 5.0.1 |
| Owncloud | Owncloud | 5.0.2 | 5.0.2 |
| Owncloud | Owncloud | 5.0.3 | 5.0.3 |
| Owncloud | Owncloud | 5.0.4 | 5.0.4 |
| Owncloud | Owncloud | 5.0.5 | 5.0.5 |
| Owncloud | Owncloud | 5.0.6 | 5.0.6 |
| Owncloud | Owncloud | 5.0.7 | 5.0.7 |
| Owncloud | Owncloud | 5.0.8 | 5.0.8 |
| Owncloud | Owncloud | 5.0.9 | 5.0.9 |
| Owncloud | Owncloud | 5.0.10 | 5.0.10 |
| Owncloud | Owncloud | 5.0.11 | 5.0.11 |
| Owncloud | Owncloud | 5.0.12 | 5.0.12 |
| Owncloud | Owncloud | 5.0.13 | 5.0.13 |
| Owncloud | Owncloud | 5.0.14 | 5.0.14 |
| Owncloud | Owncloud | 5.0.14 | 5.0.14 |
| Owncloud | Owncloud | 5.0.15 | 5.0.15 |
| Owncloud | Owncloud | 5.0.16 | 5.0.16 |
| Owncloud | Owncloud | * | 5.0.17 |
| Owncloud | Owncloud | 6.0.0 | 6.0.0 |
| Owncloud | Owncloud | 6.0.1 | 6.0.1 |
| Owncloud | Owncloud | 6.0.2 | 6.0.2 |
| Owncloud | Owncloud | 6.0.3 | 6.0.3 |
| Owncloud | Owncloud | 6.0.4 | 6.0.4 |
| Owncloud | Owncloud | 6.0.5 | 6.0.5 |
| Owncloud | Owncloud | 7.0.0 | 7.0.0 |
| Owncloud | Owncloud | 7.0.1 | 7.0.1 |
| Owncloud | Owncloud | 7.0.2 | 7.0.2 |