CVE-2013-2089 : Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authen

Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted file, then accessing it via a direct request to the file in /data.

Published 2014-03-14 16:55:06

Updated 2014-03-17 15:36:38

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2013-2089

Owncloud » Owncloud
Versions up to, including, (<=) 5.0.5
cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
Matching versions
Owncloud » Owncloud » Version: 5.0.0
cpe:2.3:a:owncloud:owncloud:5.0.0:*:*:*:*:*:*:*
Matching versions
Owncloud » Owncloud » Version: 5.0.2
cpe:2.3:a:owncloud:owncloud:5.0.2:*:*:*:*:*:*:*
Matching versions
Owncloud » Owncloud » Version: 5.0.4
cpe:2.3:a:owncloud:owncloud:5.0.4:*:*:*:*:*:*:*
Matching versions
Owncloud » Owncloud » Version: 5.0.1
cpe:2.3:a:owncloud:owncloud:5.0.1:*:*:*:*:*:*:*
Matching versions
Owncloud » Owncloud » Version: 5.0.3
cpe:2.3:a:owncloud:owncloud:5.0.3:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-2089

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-2089

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.6	MEDIUM	AV:N/AC:H/Au:S/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Network Access Complexity: High Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

References for CVE-2013-2089

http://owncloud.org/about/security/advisories/oC-SA-2013-026/

Security Advisories – ownCloud
Vendor Advisory;Patch

Jump to

Vulnerability Details : CVE-2013-2089

Products affected by CVE-2013-2089

Exploit prediction scoring system (EPSS) score for CVE-2013-2089

CVSS scores for CVE-2013-2089

References for CVE-2013-2089