CVE-2012-4396

Severity Score

6.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.

Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en ownCloud anterior a v4.0.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) nombre de ficheros para apps/user_ldap/settings.php; (2) url o (3) parámetro título para apps/bookmarks/ajax/editBookmark.php; (4) etiqueta o (5) parámetro page para apps/bookmarks/ajax/updateList.php; (6) identity para apps/user_openid/settings.php; (7) nombre stack en apps/gallery/lib/tiles.php; (8) parámetro root para apps/gallery/templates/index.php; (9) calendar displayname en apps/calendar/templates/part.import.php; (10) calendar uri en apps/calendar/templates/part.choosecalendar.rowfields.php; (11) título, (12) localización, o (13) parámetro descripción en apps/calendar/lib/object.php; (14) ciertos vectores en core/js/multiselect.js; o (15) artist, (16) album, o (17) title comments parámetros en apps/media/lib_scanner.php.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-08-21 CVE Reserved
2012-09-05 CVE Published
2024-09-17 CVE Updated
2024-09-17 First Exploit
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (11)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2012/08/11/1	Mailing List
http://www.openwall.com/lists/oss-security/2012/09/02/2	Mailing List

URL	Date	SRC
https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027	2024-09-17
https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7	2024-09-17
https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438	2024-09-17
https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c	2024-09-17
https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606	2024-09-17
https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48	2024-09-17
https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254	2024-09-17
https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb	2024-09-17

URL	Date	SRC
https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5	2012-09-06

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				<= 4.0.1 Search vendor "Owncloud" for product "Owncloud" and version " <= 4.0.1"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.0 Search vendor "Owncloud" for product "Owncloud" and version "3.0.0"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.1 Search vendor "Owncloud" for product "Owncloud" and version "3.0.1"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.2 Search vendor "Owncloud" for product "Owncloud" and version "3.0.2"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				3.0.3 Search vendor "Owncloud" for product "Owncloud" and version "3.0.3"		-		Affected
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				4.0.0 Search vendor "Owncloud" for product "Owncloud" and version "4.0.0"		-		Affected