Description

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.

Remediation

References

CVE-2015-6670

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-32478)

Dolphin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-4333)

WordPress Plugin Acunetix Secure WordPress Cross-Site Request Forgery (3.0.2)

WordPress Plugin BuddyPress PHP Object Injection (2.0.2)

Oracle Database Server CVE-2013-3760 Vulnerability (CVE-2013-3760)

Severity

Medium

Classification

CVE-2015-6670

Tags

Missing Update Known Vulnerabilities