Description

lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.

Remediation

References

CVE-2012-5336

Related Vulnerabilities

Plone CMS Weak Password Requirements Vulnerability (CVE-2020-7940)

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Information Disclosure (3.9.0)

Seo Panel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-14384)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5014)

WordPress Ultimate Member Plugin Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2019-10270)

Severity

Medium

Classification

CVE-2012-5336 CWE-20

Tags

Missing Update Known Vulnerabilities