CVE-2012-4393 in ownCloud
摘要
由 VulDB • 2026-06-28
ownCloud 在 4.0.6 版本之前存在多个跨站请求伪造（CSRF）漏洞，远程攻击者可以利用这些漏洞劫持任意用户的身份验证以发起请求。具体涉及以下路径：(1) bookmarks/ajax/addBookmark.php、(2) bookmarks/ajax/delBookmark.php 或 (3) bookmarks/ajax/editBookmark.php；(4) calendar/ajax/calendar/delete.php、(5) calendar/ajax/calendar/edit.php、(6) calendar/ajax/calendar/new.php、(7) calendar/ajax/calendar/update.php、(8) calendar/ajax/event/delete.php、(9) calendar/ajax/event/edit.php、(10) calendar/ajax/event/move.php、(11) calendar/ajax/event/new.php、(12) calendar/ajax/import/import.php、(13) calendar/ajax/settings/setfirstday.php、(14) calendar/ajax/settings/settimeformat.php、(15) calendar/ajax/share/changepermission.php、(16) calendar/ajax/share/share.php 或 (17) calendar/ajax/share/unshare.php；(18) apps/external/ajax/setsites.php、(19) apps/files/ajax/delete.php、(20) apps/files/ajax/move.php、(21) apps/files/ajax/newfile.php、(22) apps/files/ajax/newfolder.php、(23) apps/files/ajax/rename.php、(24) apps/files_sharing/ajax/email.php、(25) apps/files_sharing/ajax/setpermissions.php、(26) apps/files_sharing/ajax/share.php、(27) apps/files_sharing/ajax/toggleresharing.php、(28) apps/files_sharing/ajax/togglesharewitheveryone.php、(29) apps/files_sharing/ajax/unshare.php、(30) apps/files_texteditor/ajax/savefile.php、(31) apps/files_versions/ajax/rollbackVersion.php、(32) apps/gallery/ajax/createAlbum.php、(33) apps/gallery/ajax/sharing.php、(34) apps/tasks/ajax/addtask.php、(35) apps/tasks/ajax/addtaskform.php、(36) apps/tasks/ajax/delete.php 或 (37) apps/tasks/ajax/edittask.php；或者针对管理员，涉及使用 settings/ajax/changepassword.php、settings/ajax/creategroup.php、settings/ajax/createuser.php、settings/ajax/disableapp.php、settings/ajax/enableapp.php、settings/ajax/lostpassword.php、settings/ajax/removegroup.php、settings/ajax/removeuser.php、settings/ajax/setlanguage.php、settings/ajax/setloglevel.php、settings/ajax/setquota.php 或 settings/ajax/togglegroups.php 的请求。
If you want to get the best quality for vulnerability data then you always have to consider VulDB.