CVE-2012-4393
Estado: ModificadaMedia (6.8)—
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.10%
- Percentil entre todas las CVEs puntuadas: 65
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-352
Referencias
- http://owncloud.org/changelog/
- http://www.openwall.com/lists/oss-security/2012/08/11/1
- http://www.openwall.com/lists/oss-security/2012/09/02/2
- https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f
- https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745
- http://owncloud.org/changelog/
- http://www.openwall.com/lists/oss-security/2012/08/11/1
- http://www.openwall.com/lists/oss-security/2012/09/02/2
- https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f
- https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745
JSON original (NVD)
Mostrar
{
"id": "CVE-2012-4393",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2012-09-05T23:55:02.913",
"references": [
{
"url": "http://owncloud.org/changelog/",
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/08/11/1",
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/09/02/2",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f",
"tags": [
"Exploit",
"Patch"
],
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745",
"tags": [
"Exploit",
"Patch"
],
"source": "secalert@redhat.com"
},
{
"url": "http://owncloud.org/changelog/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/08/11/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2012/09/02/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f",
"tags": [
"Exploit",
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745",
"tags": [
"Exploit",
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en ownCloud anterior a v4.0.6 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para las solicitudes que utilizan (1) addBookmark.php, (2) delBookmark.php, o (3) editBookmark.php en bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) o share/unshare.php en calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/a! jax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, o (37) tasks/ajax/edittask.php en apps/; o administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, o (49) togglegroups.php en settings/ajax/."
}
],
"lastModified": "2026-06-16T23:44:55.957",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1FA4A92-1FE7-4E83-B951-F33B0569835B",
"versionEndIncluding": "4.0.5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77DE37D0-74E5-4D66-8A2D-DA177936A4F0"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB0E5BB3-900E-4D95-B302-4120567B6155"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1BB82C7-11E5-44E4-9029-76AE1F4AE937"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40348D52-10C6-4436-84DC-4B63271AF180"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D77D4260-0D48-47EE-A09B-FC200CB36A38"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78FEEBC0-9483-4EBE-B6E4-5390144A36F5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DED1F21-0941-4E3C-BA04-15D1C3B685C4"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A7951FE-9C41-4CCF-933F-56204147148B"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F36384F-ECB2-48F5-AB32-85AB643CD816"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}