CVE-2013-0299 Cross-site request forgery in n/a
Remote attackers can hijack user sessions to modify settings, import accounts, or overwrite files via CSRF in ownCloud.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2013-0299?
CVE-2013-0299 is a medium-severity vulnerability in Owncloud Owncloud, published on 14 Mar 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
Weakness: CWE-352
Which versions are affected by CVE-2013-0299?
It affects 2 products.
Products include Owncloud Owncloud, Owncloud Owncloud Server.
How do I fix CVE-2013-0299?
No fix has been published for CVE-2013-0299 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-0299 being exploited?
There is no known exploitation of CVE-2013-0299 in the wild and no public exploit code.
Other vulnerabilities in Owncloud Owncloud
Sources
Also known as GHSA-x92g-43qc-p6jq.