Description

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter.

Remediation

References

CVE-2013-2043

Related Vulnerabilities

Oracle Application Server CVE-2007-5521 Vulnerability (CVE-2007-5521)

jQuery UI Tooltip Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41183)

WordPress Plugin Booster for WooCommerce Multiple Vulnerabilities (5.6.6)

WordPress Plugin Simple 301 Redirects-Addon-Bulk Uploader Multiple Security Bypass Vulnerabilities (1.2.4)

WordPress Plugin AccessPress iFeeds includes Backdoor [Only if downloaded via the vendor website] (4.0.3)

Severity

Medium

Classification

CVE-2013-2043 CWE-264

Tags

Missing Update Known Vulnerabilities