Description

The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints. This affects ownCloud/core version < 10.6.

Remediation

References

CVE-2020-28644

Related Vulnerabilities

Drupal Core 4.7.x Denial of Service (4.7.0 - 4.7.4)

WordPress Plugin EventON Cross-Site Scripting (3.0.5)

WordPress Plugin GDPR Cookie Consent Security Bypass (1.8.2)

WordPress Other Vulnerability (CVE-2007-0540)

WordPress Plugin Advanced Forms for ACF Security Bypass (1.6.8)

Severity

Medium

Classification

CVE-2020-28644 CWE-352 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities