CVE Vulnerabilities

CVE-2014-9045

Improper Authentication

Published: Feb 04, 2015 | Modified: Feb 05, 2015
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Owncloud Owncloud 5.0.11 5.0.11
Owncloud Owncloud 5.0.6 5.0.6
Owncloud Owncloud 5.0.2 5.0.2
Owncloud Owncloud 6.0.5 6.0.5
Owncloud Owncloud 6.0.2 6.0.2
Owncloud Owncloud 5.0.3 5.0.3
Owncloud Owncloud 5.0.9 5.0.9
Owncloud Owncloud 5.0.7 5.0.7
Owncloud Owncloud 5.0.16 5.0.16
Owncloud Owncloud 5.0.0 5.0.0
Owncloud Owncloud 5.0.14 5.0.14
Owncloud Owncloud 5.0.1 5.0.1
Owncloud Owncloud 6.0.4 6.0.4
Owncloud Owncloud 5.0.12 5.0.12
Owncloud Owncloud 5.0.4 5.0.4
Owncloud Owncloud 5.0.13 5.0.13
Owncloud Owncloud 5.0.14 5.0.14
Owncloud Owncloud 5.0.8 5.0.8
Owncloud Owncloud * 5.0.17
Owncloud Owncloud 6.0.3 6.0.3
Owncloud Owncloud 5.0.15 5.0.15
Owncloud Owncloud 5.0.10 5.0.10
Owncloud Owncloud 6.0.0 6.0.0
Owncloud Owncloud 5.0.5 5.0.5
Owncloud Owncloud 6.0.1 6.0.1

Potential Mitigations

References