CVE-2015-6670

ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
owncloudowncloud_server
7.0.0
owncloudowncloud_server
7.0.1
owncloudowncloud_server
7.0.2
owncloudowncloud_server
7.0.3
owncloudowncloud_server
7.0.4
owncloudowncloud_server
7.0.5
owncloudowncloud_server
7.0.6
owncloudowncloud_server
7.0.7
owncloudowncloud_server
8.0.0
owncloudowncloud_server
8.0.2
owncloudowncloud_server
8.0.3
owncloudowncloud_server
8.0.4
owncloudowncloud_server
8.0.5
owncloudowncloud_server
8.1.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
owncloud
precise
not-affected
trusty
dne
vivid
dne
wily
dne
References
http://www.debian.org/security/2015/dsa-3373
https://owncloud.org/security/advisory/?id=oc-sa-2015-015
http://www.debian.org/security/2015/dsa-3373
https://owncloud.org/security/advisory/?id=oc-sa-2015-015