CVE-2015-4718 Command injection in n/a
Authenticated users can execute arbitrary SMB commands via semicolon injection in file names, potentially leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-4718?
CVE-2015-4718 is a critical command injection vulnerability in Owncloud Owncloud, published on 21 Oct 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
Weakness: CWE-78
Which versions are affected by CVE-2015-4718?
It affects 2 products.
Products include Owncloud Owncloud, Owncloud Owncloud Server.
How do I fix CVE-2015-4718?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2015-4718 being exploited?
There is no known exploitation of CVE-2015-4718 in the wild and no public exploit code.
Other vulnerabilities in Owncloud Owncloud
Sources
Also known as GHSA-x4hm-9x5q-gw23.