CVE-2014-3834
HighSummary
ownCloud Server before 6.0.3 does not properly check permissions, allowing remote authenticated users to access other users' contacts via the address book or rename files via unspecified vectors.
Risk Assessment
This vulnerability may lead to unauthorized access to personal data and file manipulation, posing a serious threat to data privacy and integrity within the organization.
Recommendation
It is recommended to update the ownCloud server to version 6.0.3 or later to mitigate this vulnerability and conduct an audit of user permissions.
Other vulnerabilities in ownCloud Server
See all- CVE-2016-1499High
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-6500High
The CVE-2015-6500 vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-4718High
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
- CVE-2015-4717High
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
- CVE-2014-2051High
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to an LDAP injection attack that can be conducted by remote attackers via unspecified vectors, as demonstrated using a 'login query.'
- CVE-2014-2056High
PHPDocX, used in ownCloud Server before version 5.0.15 and 6.0.x before version 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
- CVE-2014-2053High
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Original NVD description (English source)
ownCloud Server before 6.0.3 does not properly check permissions, which allows remote authenticated users to (1) access the contacts of other users via the address book or (2) rename files via unspecified vectors.