CVE-2015-4715

Katalog CVE

CVSS 4.9 · Medium EPSS 1,4%

Kerentanan Files or Directories Accessible to External Parties pada owncloud, owncloud server. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.

Rincian

Terbit di NVD

17 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/ advisory vendor
• https://owncloud.org/security/advisory/?id=oc-sa-2015-005 advisory vendor
• https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a patch · advisory pihak ketiga
• http://www.securityfocus.com/bid/76158 advisory pihak ketiga · vdb entry