CVE - CVE-2012-4396

CVE-ID
CVE-2012-4396	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027 CONFIRM:https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5 CONFIRM:https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7 CONFIRM:https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438 CONFIRM:https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c CONFIRM:https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606 CONFIRM:https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48 CONFIRM:https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254 CONFIRM:https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb MLIST:[oss-security] 20120810 ownCloud - matching CVEs to fix information and vice versa URL:http://www.openwall.com/lists/oss-security/2012/08/11/1 MLIST:[oss-security] 20120901 Re: CVE - ownCloud URL:http://www.openwall.com/lists/oss-security/2012/09/02/2
Assigning CNA
Red Hat, Inc.
Date Record Created
20120821	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120821)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is a record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)