« Volver al listado

CVE-2013-1822

Estado: ModificadaBaja (2.1)—

Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Owncloud — Owncloud Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1822",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-03-14T16:55:04.880",
  "references": [
    {
      "url": "http://owncloud.org/about/security/advisories/oC-SA-2013-008/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://owncloud.org/about/security/advisories/oC-SA-2013-008/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) \"share with\" field."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de XSS en ownCloud 4.5.x anterior a 4.5.8 permiten a usuarios remotos autenticados con privilegios de administrador inyectar script Web o HTML arbitrarios a través de (1) el parámetro quota hacia /core/settings/ajax/setquota.php o usuarios remotos autenticados con privilegios de administración de grupos inyectar script Web o HTML arbitrarios a través de (2) el campo group hacia settings.php o (3) el campo \"share with\"."
    }
  ],
  "lastModified": "2026-06-16T23:52:11.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56D46962-C2C4-4468-9DB0-15AFF4FE8032"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8577131-CCE2-4B98-8763-8F99E267BD5B"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A6F6FF-7E31-4337-93E0-ED05D3D698D4"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C21E9F9A-5734-4819-8845-E82ADC29ABD2"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D57EBB84-E1B2-44F4-BD7B-8D4A79A2E2D3"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E90708D-CA85-4034-ADA7-72522812CEF6"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA2C4F18-4056-4ED3-B1E7-C945849FE97C"
            },
            {
              "criteria": "cpe:2.3:a:owncloud:owncloud_server:4.5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE1FA818-0C13-4F41-9AF8-F31B035491F4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}