« Volver al listado

CVE-2012-5607

Estado: ModificadaMedia (5)—

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Owncloud — OwncloudOwncloud — Owncloud Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-5607",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-12-18T01:55:07.287",
  "references": [
    {
      "url": "http://owncloud.org/changelog/",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://owncloud.org/security/advisories/oc-sa-2012-002/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/11/30/3",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/owncloud/core/commit/99cd922",
      "tags": [
        "Patch"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://owncloud.org/changelog/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://owncloud.org/security/advisories/oc-sa-2012-002/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2012/11/30/3",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/owncloud/core/commit/99cd922",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The \"Lost Password\" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a \"Remote Timing Attack.\""
    },
    {
      "lang": "es",
      "value": "La funcionalidad de reinicio \"Contraseña olvidada\" en ownCloud v4.0.9 y antes de v4.5.0 no comprueba correctamente el token de seguridad, lo que permite a atacantes remotos para cambiar la contraseña de las cuentas a través de vectores no especificados relacionados con un \"Remote Timing Attack\"."
    }
  ],
  "lastModified": "2026-06-16T23:47:04.627",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AB005B3-22C4-4365-B287-FBF77657DE66",
              "versionEndIncluding": "4.0.8"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77DE37D0-74E5-4D66-8A2D-DA177936A4F0"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB0E5BB3-900E-4D95-B302-4120567B6155"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1BB82C7-11E5-44E4-9029-76AE1F4AE937"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40348D52-10C6-4436-84DC-4B63271AF180"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D77D4260-0D48-47EE-A09B-FC200CB36A38"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78FEEBC0-9483-4EBE-B6E4-5390144A36F5"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DED1F21-0941-4E3C-BA04-15D1C3B685C4"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A7951FE-9C41-4CCF-933F-56204147148B"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F36384F-ECB2-48F5-AB32-85AB643CD816"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DA03000-6D01-4CDA-8C83-C2AFC649B869"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8206EE35-2939-44B4-BBCF-C384C6206122"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7E07400-C700-454C-B5EF-4992F2089BE1"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56D46962-C2C4-4468-9DB0-15AFF4FE8032"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}