CVEvulnerability
CVE-2012-5607
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-12-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-255
Description
The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."
Affected configurations
• owncloud owncloud (<= 4.0.8)
• owncloud owncloud server 3.0.0
• owncloud owncloud server 3.0.1
• owncloud owncloud server 3.0.2
• owncloud owncloud server 3.0.3
• owncloud owncloud server 4.0.0
• owncloud owncloud server 4.0.1
• owncloud owncloud server 4.0.2
• owncloud owncloud server 4.0.3
• owncloud owncloud server 4.0.4
• owncloud owncloud server 4.0.5
• owncloud owncloud server 4.0.6
• owncloud owncloud server 4.0.7
• owncloud owncloud server 4.5.0
Related
Weakness · not in database (1)
References
- http://owncloud.org/changelog/ owncloud.org
- http://owncloud.org/security/advisories/oc-sa-2012-002/ Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/30/3 Patch
- https://github.com/owncloud/core/commit/99cd922 Patch
- http://owncloud.org/changelog/ owncloud.org
- http://owncloud.org/security/advisories/oc-sa-2012-002/ Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/11/30/3 Patch
- https://github.com/owncloud/core/commit/99cd922 Patch