Description
lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
Remediation
References
Related Vulnerabilities
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3732)
SharePoint Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2019-1202)
WordPress Plugin RoyalSlider Cross-Site Scripting (3.2.4)
WordPress Plugin All In One Schema.org Rich Snippets Cross-Site Scripting (1.4.4)
WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (3.81)