CVE-2014-2051
HighSummary
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to an LDAP injection attack that can be conducted by remote attackers via unspecified vectors, as demonstrated using a 'login query.'
Risk Assessment
An LDAP injection attack may allow remote attackers to manipulate authentication data, leading to unauthorized access to the system.
Recommendation
It is recommended to update ownCloud Server to version 5.0.15 or 6.0.2 and later to mitigate this vulnerability.
Other vulnerabilities in ownCloud Server
See all- CVE-2016-1499High
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-6500High
The CVE-2015-6500 vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-4718High
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
- CVE-2015-4717High
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
- CVE-2014-3834High
ownCloud Server before 6.0.3 does not properly check permissions, allowing remote authenticated users to access other users' contacts via the address book or rename files via unspecified vectors.
- CVE-2014-2056High
PHPDocX, used in ownCloud Server before version 5.0.15 and 6.0.x before version 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
- CVE-2014-2053High
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Original NVD description (English source)
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to conduct an LDAP injection attack via unspecified vectors, as demonstrated using a "login query."