CVE-2015-4715 Path traversal in n/a
Remote Dropbox administrators can read arbitrary files on ownCloud servers via path traversal in the fetch function when external storage is mounted.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4715?
CVE-2015-4715 is a medium-severity path traversal vulnerability in Owncloud Owncloud, published on 17 Feb 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
Weakness: CWE-552
Which versions are affected by CVE-2015-4715?
It affects 2 products.
Products include Owncloud Owncloud, Owncloud Owncloud Server.
How do I fix CVE-2015-4715?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-4715 being exploited?
There is no known exploitation of CVE-2015-4715 in the wild and no public exploit code.
Other vulnerabilities in Owncloud Owncloud
Sources
Also known as GHSA-82h9-wxqp-j6pq.