Description

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

Remediation

References

CVE-2013-0304

Related Vulnerabilities

MediaWiki Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2023-45364)

XWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-46732)

WordPress Plugin Xhanch-My Twitter Multiple Cross-Site Request Forgery Vulnerabilities (2.7.7)

Oracle JRE CVE-2013-1561 Vulnerability (CVE-2013-1561)

WordPress Plugin GS Books Showcase Cross-Site Scripting (1.3.0)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2013-0304