« Volver al listado

CVE-2013-0304

Estado: ModificadaMedia (4)—

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Owncloud — OwncloudOwncloud — Owncloud Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-0304",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-05T15:44:07.743",
  "references": [
    {
      "url": "http://owncloud.org/about/security/advisories/oC-SA-2013-007/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://owncloud.org/about/security/advisories/oC-SA-2013-007/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php.  NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is."
    },
    {
      "lang": "es",
      "value": "ownCloud Server anterior a 4.5.7 no comprueba debidamente la propiedad de calendarios, lo que permite a usuarios remotos autenticados leer archivos calendarios arbitrarios a través del parámetro calid en /apps/calendar/export.php. NOTA: este problema ha sido reportado como una vulnerabilidad de CSRF, pero debido a una falta de detalles, no está claro cual la causa de raíz."
    }
  ],
  "lastModified": "2026-06-16T23:49:09.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD2D06C0-2A80-40B1-AEA8-F63FF8CE8CFE",
              "versionEndIncluding": "4.5.6"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56D46962-C2C4-4468-9DB0-15AFF4FE8032"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8577131-CCE2-4B98-8763-8F99E267BD5B"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A6F6FF-7E31-4337-93E0-ED05D3D698D4"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C21E9F9A-5734-4819-8845-E82ADC29ABD2"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D57EBB84-E1B2-44F4-BD7B-8D4A79A2E2D3"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E90708D-CA85-4034-ADA7-72522812CEF6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}