Description

apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allows remote authenticated users to download arbitrary calendars via the calendar_id parameter.

Remediation

References

CVE-2013-2043

Related Vulnerabilities

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-3463)

MediaWiki Improper Authentication Vulnerability (CVE-2014-2665)

Zope Web Application Server Other Vulnerability (CVE-2006-3458)

WordPress Plugin Import/Export Customizer Settings Cross-Site Request Forgery (1.0.3)

WordPress Plugin Gallery-Flagallery Photo Portfolio 'skin' Parameter Cross-Site Scripting (1.72)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2013-2043