CVE-2015-6670 ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the cal...
MediumCVSS 4.0
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| owncloud server | = 7.0.0 | No fix listed |
| owncloud server | = 7.0.1 | No fix listed |
| owncloud server | = 7.0.2 | No fix listed |
| owncloud server | = 7.0.3 | No fix listed |
| owncloud server | = 7.0.4 | No fix listed |
| owncloud server | = 7.0.5 | No fix listed |
| owncloud server | = 7.0.6 | No fix listed |
| owncloud server | = 7.0.7 | No fix listed |
| owncloud server | = 8.0.0 | No fix listed |
| owncloud server | = 8.0.2 | No fix listed |
| owncloud server | = 8.0.3 | No fix listed |
| owncloud server | = 8.0.4 | No fix listed |
| owncloud server | = 8.0.5 | No fix listed |
| owncloud server | = 8.1.0 | No fix listed |
References
- DSA-3373 vendor-advisory
- owncloud.org vendor-advisory