CVE-2023-24804

Katalog CVE

CVSS 4.4 · Medium EPSS 0,52%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada owncloud client. Skor CVSS 3.1 4.4 (Medium) menurut NVD.

Deskripsi (NVD)

The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Prior to version 3.0, the app has an incomplete fix for a path traversal issue and is vulnerable to two bypass methods. The bypasses may lead to information disclosure when uploading the app’s internal files, and to arbitrary file write when uploading plain text files (although limited by the .txt extension). Version 3.0 fixes the reported bypasses.

Rincian

Terbit di NVD

13 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.4 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://owncloud.com/security-advisories/oc-sa-2023-001/ advisory vendor
• https://hackerone.com/reports/377107 exploit · advisory pihak ketiga
• https://securitylab.github.com/advisories/GHSL-2022-059_GHSL-2022-060_Owncloud_Android_app/ exploit · advisory pihak ketiga