CVE-2013-0299
Estado: ModificadaMedia (6.8)—
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
- Puntuación base: 6.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.61%
- Percentil entre todas las CVEs puntuadas: 48
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-352
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2013-0299",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-03-14T17:55:06.937",
"references": [
{
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-004/",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-004/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de CSRF en ownCloud anterior a 4.0.12 y 4.5.x anterior a 4.5.7 permiten a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que (1) cambian la zona horaria para el usuario a través de los parámetros lat y lng hacia apps/calendar/ajax/settings/guesstimezone.php, (2) deshabilitan o habilitan la detección de zona horaria automatica a través del parámetro timezonedetection hacia apps/calendar/ajax/settings/timezonedetection.php, (3) importan cuentas de usuario a través del parámetro admin_export hacia apps/admin_migrate/settings.php, (4) sobreescriben archivos de usuario a través del parámetro operation hacia apps/user_migrate/ajax/export.php o (5) cambian la URL del servidor de autenticación a través de vectores no especificados hacia apps/user_ldap/settings.php."
}
],
"lastModified": "2026-06-16T23:49:09.017",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5861C327-743A-41DF-8326-1696620194D3",
"versionEndIncluding": "4.0.11"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "77DE37D0-74E5-4D66-8A2D-DA177936A4F0"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB0E5BB3-900E-4D95-B302-4120567B6155"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1BB82C7-11E5-44E4-9029-76AE1F4AE937"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:3.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40348D52-10C6-4436-84DC-4B63271AF180"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D77D4260-0D48-47EE-A09B-FC200CB36A38"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78FEEBC0-9483-4EBE-B6E4-5390144A36F5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DED1F21-0941-4E3C-BA04-15D1C3B685C4"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A7951FE-9C41-4CCF-933F-56204147148B"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F36384F-ECB2-48F5-AB32-85AB643CD816"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7DA03000-6D01-4CDA-8C83-C2AFC649B869"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8206EE35-2939-44B4-BBCF-C384C6206122"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7E07400-C700-454C-B5EF-4992F2089BE1"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D068E80A-1504-4814-88BF-7A183F5A7CD5"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3ACF1A42-0F83-4771-B097-CF497439C4D6"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF99DF50-3984-4F56-B2C8-4FA387627490"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56D46962-C2C4-4468-9DB0-15AFF4FE8032"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8577131-CCE2-4B98-8763-8F99E267BD5B"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79A6F6FF-7E31-4337-93E0-ED05D3D698D4"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C21E9F9A-5734-4819-8845-E82ADC29ABD2"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D57EBB84-E1B2-44F4-BD7B-8D4A79A2E2D3"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E90708D-CA85-4034-ADA7-72522812CEF6"
},
{
"criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA2C4F18-4056-4ED3-B1E7-C945849FE97C"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert@redhat.com"
}