CVE-2014-3963

Severity Score

4.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ownCloud Server before 6.0.1 does not properly check permissions, which allows remote authenticated users to access arbitrary preview pictures via unspecified vectors.

ownCloud Server anterior a 6.0.1 no comprueba debidamente permisos, lo que permite a usuarios remotos autenticados acceder a vistas preliminares de imágenes a través de vectores no especificados.

*Credits: N/A

CVSS Scores

NISTv2 4.0

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-06-04 CVE Reserved
2014-06-04 CVE Published
2024-09-16 CVE Updated
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
http://owncloud.org/about/security/advisories/oC-SA-2014-009	2014-06-05

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Owncloud Search vendor "Owncloud"		Owncloud Search vendor "Owncloud" for product "Owncloud"				<= 6.0.0 Search vendor "Owncloud" for product "Owncloud" and version " <= 6.0.0"		-		Affected