CVE-2012-4396

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.

Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) nombre de ficheros para apps/user_ldap/settings.php; (2) url o (3) parámetro título para apps/bookmarks/ajax/editBookmark.php; (4) etiqueta o (5) parámetro page para apps/bookmarks/ajax/updateList.php; (6) identity para apps/user_openid/settings.php; (7) nombre stack en apps/gallery/lib/tiles.php; (8) parámetro root para apps/gallery/templates/index.php; (9) calendar displayname en apps/calendar/templates/part.import.php; (10) calendar uri en apps/calendar/templates/part.choosecalendar.rowfields.php; (11) título, (12) localización, o (13) parámetro descripción en apps/calendar/lib/object.php; (14) ciertos vectores en core/js/multiselect.js; o (15) artist, (16) album, o (17) title comments parámetros en apps/media/lib_scanner.php.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-08-21 CVE Reserved
2012-09-05 CVE Published
2024-09-17 CVE Updated
2024-09-17 First Exploit
2024-09-24 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (11)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2012/08/11/1	Mailing List
http://www.openwall.com/lists/oss-security/2012/09/02/2	Mailing List

URL	Date	SRC
https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027	2024-09-17
https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7	2024-09-17
https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438	2024-09-17
https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c	2024-09-17
https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606	2024-09-17
https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48	2024-09-17
https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254	2024-09-17
https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb	2024-09-17

URL	Date	SRC
https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5	2012-09-06

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				<= 4.0.1 Search vendor "Owncloud" for product "Owncloud" and version " <= 4.0.1"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.0 Search vendor "Owncloud" for product "Owncloud" and version "3.0.0"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.1 Search vendor "Owncloud" for product "Owncloud" and version "3.0.1"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.2 Search vendor "Owncloud" for product "Owncloud" and version "3.0.2"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.3 Search vendor "Owncloud" for product "Owncloud" and version "3.0.3"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				4.0.0 Search vendor "Owncloud" for product "Owncloud" and version "4.0.0"		-		Affected