Description

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Remediation

References

CVE-2015-6670

Related Vulnerabilities

WordPress Plugin IMPress for IDX Broker Unspecified Vulnerability (2.5.11)

ownCloud Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2015-7698)

Drupal Core 8.x Multiple Vulnerabilities (8.0.0 - 8.1.9)

Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.56)

WordPress Plugin Arlo training and event management system Cross-Site Scripting (2.1.7.1)

Severity

Medium

Classification

CVE-2015-6670

Tags

Missing Update Known Vulnerabilities