Vulnerability in Owncloud
CVE-2015-4717
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
EPSS: 0.028 (85.2th percentile) — read the EPSS interpretation.
Affected products
- Owncloud
- Owncloud Owncloud_server — versions 7.0.0, 7.0.1, 7.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)