Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
References
| Link | Resource |
|---|---|
| http://owncloud.org/about/security/advisories/oC-SA-2013-008/ | Vendor Advisory |
| http://owncloud.org/about/security/advisories/oC-SA-2013-008/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
31 Mar 2025, 11:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:owncloud:owncloud:4.5.2:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.5:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.3:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.7:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.4:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.1:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud:4.5.0:*:*:*:*:*:*:* |
cpe:2.3:a:owncloud:owncloud_server:4.5.2:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.0:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.1:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.7:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.3:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.5:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.4:*:*:*:*:*:*:* cpe:2.3:a:owncloud:owncloud_server:4.5.6:*:*:*:*:*:*:* |
| First Time |
Owncloud owncloud Server
|
Information
Published : 2014-03-14 16:55
Updated : 2025-04-12 10:46
NVD link : CVE-2013-1822
Mitre link : CVE-2013-1822
CVE.ORG link : CVE-2013-1822
JSON object : View
Products Affected
owncloud
- owncloud_server
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')