Description

ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share.

Remediation

References

CVE-2016-1500

Related Vulnerabilities

WordPress Plugin Contact Form DB Cross-Site Scripting (2.10.29)

Joomla! Core 3.x.x Information Disclosure (3.6.0 - 3.9.12)

concrete5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-6908)

PostgreSQL Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2018-1053)

WordPress Plugin BackupBuddy Information Disclosure (2.2.28)

Severity

Low

Classification

CVE-2016-1500 CWE-200 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities