Auth bypass in Owncloud
CVE-2014-9043
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
Vulnerability class: Broken Authentication
EPSS: 0.019 (77.1th percentile) — read the EPSS interpretation.
Affected products
- Owncloud
- Owncloud Owncloud_server — versions 5.0.0, 5.0.1, 5.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)