CVE-2015-3013 File upload in n/a
Authenticated users can bypass file blacklist restrictions to upload malicious files, potentially leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3013?
CVE-2015-3013 is a medium-severity vulnerability in Owncloud Owncloud Server, published on 8 May 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ownCloud Server before 5.0.19, 6.x before 6.0.7, and 7.x before 7.0.5 allows remote authenticated users to bypass the file blacklist and upload arbitrary files via a file path with UTF-8 encoding, as demonstrated by uploading a .htaccess file.
Weakness: CWE-74
Which versions are affected by CVE-2015-3013?
It affects 1 product.
Products include Owncloud Owncloud Server.
How do I fix CVE-2015-3013?
Upgrade to a fixed version.
Is CVE-2015-3013 being exploited?
There is no known exploitation of CVE-2015-3013 in the wild and no public exploit code.
Other vulnerabilities in Owncloud Owncloud Server
Sources
Also known as GHSA-p25j-x86q-r8rc.