What is CVE-2016-1499?

CVE-2016-1499 is a high-severity vulnerability in Owncloud, classified under Information Disclosure. CVSS score: 8.5/10. Published 2016-01-08.

How severe is CVE-2016-1499?

High severity. CVSS v3 base score is 8.5 out of 10.

Information disclosure in Owncloud

CVE-2016-1499

ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.

Vulnerability class: Information Disclosure

EPSS: 0.035 (87.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H.

Affected products

Owncloud — versions 8.2.0, 8.2.1
Owncloud Owncloud_server — versions 8.1.0, 8.1.1, 8.1.3
N/a — versions n/a

Weakness classification (CWE)

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Exploit, x_refsource_MISC)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2016-1499?: CVE-2016-1499 is a high-severity vulnerability in Owncloud, classified under Information Disclosure. CVSS score: 8.5/10. Published 2016-01-08.
How severe is CVE-2016-1499?: High severity. CVSS v3 base score is 8.5 out of 10.