CVE-2021-35949

Description

The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and list metadata about the share.

Related CPE's

a owncloud owncloud ********

References

https://owncloud.com/security-advisories/cve-2021-35949/

Vendor Advisory

https://doc.owncloud.com/server/admin_manual/release_notes.html

Release NotesVendor Advisory

CvssV3 impact

BaseSeverity	MEDIUM
ConfidentialityImpact	LOW
AttackComplexity	LOW
Scope	UNCHANGED
AttackVector	NETWORK
AvailabilityImpact	NONE
IntegrityImpact	NONE
PrivilegesRequired	NONE
BaseScore	5.3
VectorString	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Version	3.1
UserInteraction	NONE

CvssV2 impact

AccessComplexity	LOW
ConfidentialityImpact	PARTIAL
AvailabilityImpact	NONE
IntegrityImpact	NONE
BaseScore	5
VectorString	AV:N/AC:L/Au:N/C:P/I:N/A:N
Version	2.0
AccessVector	NETWORK
Authentication	NONE

Created by Yello

About Severity.io