CVE-2015-5954 Missing authorization in n/a
Authenticated users can bypass access restrictions to read files via sharing links when parent folders are deleted due to improper NULL handling in the virtual filesystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5954?
CVE-2015-5954 is a medium-severity missing authorization vulnerability in Owncloud Owncloud, published on 21 Oct 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder.
Which versions are affected by CVE-2015-5954?
It affects 2 products.
Products include Owncloud Owncloud, Owncloud Owncloud Server.
How do I fix CVE-2015-5954?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-5954 being exploited?
There is no known exploitation of CVE-2015-5954 in the wild and no public exploit code.
Other vulnerabilities in Owncloud Owncloud
Sources
Also known as GHSA-9hxw-x8cc-hmwq.