CVE-2015-6670

EUVD-2015-6608
ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
owncloudowncloud_server
7.0.0
owncloudowncloud_server
7.0.1
owncloudowncloud_server
7.0.2
owncloudowncloud_server
7.0.3
owncloudowncloud_server
7.0.4
owncloudowncloud_server
7.0.5
owncloudowncloud_server
7.0.6
owncloudowncloud_server
7.0.7
owncloudowncloud_server
8.0.0
owncloudowncloud_server
8.0.2
owncloudowncloud_server
8.0.3
owncloudowncloud_server
8.0.4
owncloudowncloud_server
8.0.5
owncloudowncloud_server
8.1.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
owncloud
precise
not-affected
trusty
dne
vivid
dne
wily
dne
References
http://www.debian.org/security/2015/dsa-3373
https://owncloud.org/security/advisory/?id=oc-sa-2015-015
http://www.debian.org/security/2015/dsa-3373
https://owncloud.org/security/advisory/?id=oc-sa-2015-015