CVE-2015-4717
HighSummary
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
Risk Assessment
Attackers can exploit this vulnerability to cause a denial of service, potentially leading to system downtime and excessive resource consumption.
Recommendation
It is recommended to update ownCloud Server to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in ownCloud Server
See all- CVE-2016-1499High
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-6500High
The CVE-2015-6500 vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
- CVE-2015-4718High
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
- CVE-2014-2051High
ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to an LDAP injection attack that can be conducted by remote attackers via unspecified vectors, as demonstrated using a 'login query.'
- CVE-2014-3834High
ownCloud Server before 6.0.3 does not properly check permissions, allowing remote authenticated users to access other users' contacts via the address book or rename files via unspecified vectors.
- CVE-2014-2056High
PHPDocX, used in ownCloud Server before version 5.0.15 and 6.0.x before version 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
- CVE-2014-2053High
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Original NVD description (English source)
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.