fkie_cve-2015-7699
Vulnerability from fkie_nvd
Published
2015-10-26 15:59
Modified
2024-11-21 02:37
Severity ?
Summary
The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore."
References
cve@mitre.orghttp://www.debian.org/security/2015/dsa-3373
cve@mitre.orghttps://github.com/owncloud/core/pull/18558
cve@mitre.orghttps://owncloud.org/security/advisory/?id=oc-sa-2015-018Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3373
af854a3a-2127-422b-91ae-364da2661108https://github.com/owncloud/core/pull/18558
af854a3a-2127-422b-91ae-364da2661108https://owncloud.org/security/advisory/?id=oc-sa-2015-018Vendor Advisory
Impacted products
Vendor Product Version
owncloud owncloud 7.0.0
owncloud owncloud 7.0.1
owncloud owncloud 7.0.2
owncloud owncloud 7.0.3
owncloud owncloud 7.0.4
owncloud owncloud 7.0.5
owncloud owncloud 7.0.6
owncloud owncloud 7.0.7
owncloud owncloud 8.0.0
owncloud owncloud 8.0.2
owncloud owncloud 8.0.3
owncloud owncloud 8.0.4
owncloud owncloud 8.0.5
owncloud owncloud 8.1.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E1941F4-D2B5-4633-A934-FBD126B72D1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "22EBDD6A-804F-44E8-A516-61760B5D447B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9FF6F676-1C9E-4F33-8E91-BC41E42CEE57",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBF3DCFD-3264-4315-947E-0D2725E3BFEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C26782F8-FE62-4B2D-B0C9-81EFFE395D6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5945851-35B8-4509-92C7-CF706C794266",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7F58319-DE37-4307-9D60-BDFC27D6826B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:7.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AD03A74-6F1D-43EC-BC93-F2AF2467F6D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8C45645-3A99-4E08-952A-EEBFE35AC70E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AFD0FA9-F12F-46A2-90F4-B48310A7ED0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C18316B-E0DF-4693-AD3A-8C923965931B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "66A3C5DA-52BA-4B86-A7A1-BEAE730E80E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "453D8D0E-B385-4A8F-9D01-CDE38E6C1D4B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:8.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "644C5331-A967-497D-A7ED-919F5988C8E8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to \"objectstore.\""
    },
    {
      "lang": "es",
      "value": "La aplicaci\u00f3n files_external en ownCloud Server en versiones anteriores a 7.0.9, 8.0.x en versiones anteriores a 8.0.7 y 8.1.x en versiones anteriores a 8.1.2 permite a usuarios remotos autenticados instanciar clases arbitrarias o posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de una opci\u00f3n de punto de montaje manipulada, relacionada con \u0027objectstore\u0027."
    }
  ],
  "id": "CVE-2015-7699",
  "lastModified": "2024-11-21T02:37:14.560",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-10-26T15:59:00.103",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2015/dsa-3373"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/owncloud/core/pull/18558"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-018"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2015/dsa-3373"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/owncloud/core/pull/18558"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-018"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.