CVE-2012-5336

lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2014-06-04

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Owncloud (Owncloud)
• Owncloud Server (Owncloud)

References

• http://owncloud.org/about/security/advisories/CVE-2012-5336/