CVE-2012-4391

Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
VendorProductVersion
owncloudowncloud
𝑥
≤ 4.0.6
owncloudowncloud_server
3.0.0
owncloudowncloud_server
3.0.1
owncloudowncloud_server
3.0.2
owncloudowncloud_server
3.0.3
owncloudowncloud_server
4.0.0
owncloudowncloud_server
4.0.1
owncloudowncloud_server
4.0.2
owncloudowncloud_server
4.0.3
owncloudowncloud_server
4.0.4
owncloudowncloud_server
4.0.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
owncloud
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
ignored
natty
ignored
lucid
dne
hardy
dne
Common Weakness Enumeration
References
http://owncloud.org/changelog/
http://www.openwall.com/lists/oss-security/2012/09/02/2
https://github.com/owncloud/core/commit/5192eecce239a0b7ade1e60a6cf03075e5cfc188
http://owncloud.org/changelog/
http://www.openwall.com/lists/oss-security/2012/09/02/2
https://github.com/owncloud/core/commit/5192eecce239a0b7ade1e60a6cf03075e5cfc188