CVEvulnerability
CVE-2015-4715
4.9 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-02-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
- Weaknesses
- CWE-552
Description
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
Affected configurations
• owncloud owncloud (< 6.0.8)
• owncloud owncloud server (>= 7.0.0 < 7.0.6)
• owncloud owncloud server (>= 8.0.0 < 8.0.4)
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- http://www.securityfocus.com/bid/76158 Third Party Advisory, VDB Entry
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a Patch, Third Party Advisory
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/ Vendor Advisory
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005 Vendor Advisory
- http://www.securityfocus.com/bid/76158 Third Party Advisory, VDB Entry
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a Patch, Third Party Advisory
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/ Vendor Advisory
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005 Vendor Advisory