CVE Vulnerabilities

CVE-2015-3013

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: May 08, 2015 | Modified: Feb 07, 2019
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Owncloud Owncloud 5.0.0 (including) 5.0.19 (excluding)
Owncloud Owncloud 6.0.0 (including) 6.0.7 (excluding)
Owncloud Owncloud 7.0.0 (including) 7.0.5 (excluding)
Owncloud Ubuntu upstream *

Potential Mitigations

References