Information disclosure in ownCloud
CVE-2016-1499
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H.
EPSS exploit prediction
EPSS: 0.035 (88.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000
Affected products
- ownCloud — versions 8.2.0, 8.2.1
- ownCloud Server — versions 8.1.0, 8.1.1, 8.1.3
Weakness classification (CWE)
References
- www.securityfocus.com/archive/1/537244/100/0/threaded (mailing-list)
- www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-062.txt (Exploit)
- packetstormsecurity.com/files/135158/ownCloud-8.2.1-8.1.4-8.0.9-Information-Exp…
- www.securityfocus.com/archive/1/537556/100/0/threaded (mailing-list)
- owncloud.org/security/advisory/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2016-1499?
- CVE-2016-1499 is a high-severity vulnerability in ownCloud, classified under Information Disclosure. CVSS score: 8.5/10. Published 2016-01-08.
- How severe is CVE-2016-1499?
- High severity. CVSS v3 base score is 8.5 out of 10.