ownCloud up to 5.0.3 ActionScript cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, was found in ownCloud. Affected is an unknown function of the component ActionScript. The manipulation results in cross site scripting. This vulnerability was named CVE-2013-1942. The attack may be performed from remote. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ownCloud (Cloud Software). Affected is some unknown functionality of the component ActionScript. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

Cross-site scripting (XSS) vulnerability in actionscript/Jplayer.as in the Flash SWF component in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.

The weakness was presented 08/15/2013 (Website). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2013-1942 since 02/19/2013. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The commercial vulnerability scanner Qualys is able to test this issue with plugin 121178 (Mozilla Firefox/Thunderbird Multiple Vulnerabilities (MFSA 2013-41 through MFSA 2013-48)).

Upgrading to version 4.0.8 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (38460) and SecurityFocus (BID 59030†). See VDB-8756, VDB-64689 and VDB-64157 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Name

• ownCloud

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.14
• 4.0.15
• 4.0.16
• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4
• 4.5.5
• 4.5.6
• 4.5.7
• 4.5.8
• 4.5.9
• 4.5.10
• 4.5.11
• 4.5.12
• 4.5.13
• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion