CVE-2015-7699 Code injection in n/a

What is CVE-2015-7699?

CVE-2015-7699 is a critical code injection vulnerability in Owncloud Owncloud Server, published on 26 Oct 2015. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The files_external app in ownCloud Server before 7.0.9, 8.0.x before 8.0.7, and 8.1.x before 8.1.2 allows remote authenticated users to instantiate arbitrary classes and possibly execute arbitrary code via a crafted mount point option, related to "objectstore."

Weakness: CWE-20

Which versions are affected by CVE-2015-7699?

It affects 1 product.

Products include Owncloud Owncloud Server.

How do I fix CVE-2015-7699?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2015-7699 being exploited?

There is no known exploitation of CVE-2015-7699 in the wild and no public exploit code.

Other vulnerabilities in Owncloud Owncloud Server

• CVE-2023-49105 ownCloud Improper Authentication Exploited Critical 9.8
• CVE-2015-6500 Path traversal in n/a High 7.5
• CVE-2014-2051 Code injection in n/a High 7.5
• CVE-2014-2054 PHPExcel vulnerable to XXE attacks through libxml High 7.5
• CVE-2014-2056 XML external entity in n/a High 7.5

All Owncloud Owncloud Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rj7h-v734-5679.