CRITICAL🇵🇱 Wersja polska

CVE-2021-35946

CVSS 9.8v3.1pub. 2021-09-07upd. 2024-11-21

A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Owncloud

    APP
    Owncloud
    < 10.8.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-28645CRITICAL9.1PL ✓same product

ownCloud: Usunięcie użytkownika powoduje usunięcie plików systemowych

CVE-2014-2052CRITICAL9.8PL ✓same product

XXE w Zend Framework umożliwia odczyt plików w ownCloud Server

CVE-2014-2048CRITICAL9.8PL ✓same product

ownCloud: niezabezpieczona implementacja OpenID umożliwia nieautoryzowany dostęp

CVE-2022-31649HIGH7.5same product

ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.

CVE-2020-10252HIGH8.3same product

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external...