ownCloud up to 4.0.1 tiles.php Comments cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in ownCloud up to 4.0.1. This vulnerability affects unknown code in the library apps/gallery/lib/tiles.php. Performing a manipulation of the argument Comments results in cross site scripting. This vulnerability was named CVE-2012-4396. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ownCloud up to 4.0.1 (Cloud Software). It has been classified as problematic. This affects some unknown functionality in the library apps/gallery/lib/tiles.php. The manipulation of the argument comments with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.

The weakness was presented 09/05/2012 (Website). It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2012-4396 since 08/21/2012. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

By approaching the search of inurl:apps/gallery/lib/tiles.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.0.0 eliminates this vulnerability.

See VDB-62046, VDB-62045, VDB-62044 and VDB-62042 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Name

• ownCloud

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 4.0.0
• 4.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion