CVE-2017-9339

EUVD-2017-18274
A logical error in ownCloud Server before 10.0.2 caused disclosure of valid share tokens for public calendars. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Affected Products (NVD)
VendorProductVersion
owncloudowncloud
𝑥
< 10.0.2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
owncloud
artful
dne
bionic
dne
cosmic
dne
disco
dne
trusty
dne
xenial
dne
yakkety
dne
zesty
dne
References
https://owncloud.org/security/advisory/?id=oc-sa-2017-005
https://owncloud.org/security/advisory/?id=oc-sa-2017-005