Vulnerability Description
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Owncloud | Owncloud | <= 6.0.7 |
| Owncloud | Owncloud Server | 7.0.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2015/dsa-3373
- http://www.securityfocus.com/bid/76161
- https://owncloud.org/security/advisory/?id=oc-sa-2015-007Vendor Advisory
- http://www.debian.org/security/2015/dsa-3373
- http://www.securityfocus.com/bid/76161
- https://owncloud.org/security/advisory/?id=oc-sa-2015-007Vendor Advisory
FAQ
What is CVE-2015-4717?
CVE-2015-4717 is a vulnerability with a CVSS score of 7.8 (HIGH). The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote a...
How severe is CVE-2015-4717?
CVE-2015-4717 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-4717?
Check the references section above for vendor advisories and patch information. Affected products include: Owncloud Owncloud, Owncloud Owncloud Server.