This host is running ownCloud and is prone to cross-site scripting and security bypass vulnerabilities.

Successful exploitation will allow remote attacker to execute arbitrary HTML or script code or discloses sensitive information resulting in loss of confidentiality.

Upgrade to ownCloud 4.5.5, 4.0.10 or later, For updates refer to http://owncloud.org

Multiple flaws are due to, - The application not verifying permissions when accessing settings.php can be exploited to change the app configuration for user_webdavauth and user_ldap and subsequently login as arbitrary users. - Certain input passed to apps/bookmark/index.php is not properly sanitised before being returned to the user.

ownCloud versions 4.0.x before 4.0.10 and 4.5.x before 4.5.5

Send a crafted data via HTTP request and check whether it is able to read cookie or not.

• http://owncloud.org/changelog
• http://secunia.com/advisories/51614
• http://www.openwall.com/lists/oss-security/2012/12/22/2
• http://www.openwall.com/lists/oss-security/2012/12/22/5
• https://github.com/owncloud/apps/commit/eafa9b2#diff-0

---

Updated on 2015-03-25