CVE Feed

    Dashboard / CVE / CVE-2012-4396

    CVE-2012-4396

    Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.

    Published:Sep 5, 2012
    Last Modified:Apr 11, 2025
    EPS:Sep 5, 2012
    EPSS Score:0.0076
    CVSS Score:4.3

    Affected Products

    Vendor
    Owncloud
    Product
    Owncloud
    Vendor
    Owncloud
    Product
    Owncloud Server

    Exploits

    https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96chttps://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bbhttps://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96chttps://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb

    Related CVEs

    CVE-2025-53831 (CVSS 8.2) — DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing app…
    CVE-2025-53830 (CVSS 9.1) — Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing applicatio…
    CVE-2025-53829 (CVSS 8) — ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3,…
    CVE-2025-53828 (CVSS 8.5) — SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sha…
    CVE-2025-53827 (CVSS 9.1) — ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCl…
    CVE-2019-25337 (CVSS 5.3) — OwnCloud 8.1.8 contains a username enumeration vulnerability that allows remote attackers to discover user acc…
    CVE-2025-59716 (CVSS 5.3) — ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{t…
    CVE-2022-43679 (CVSS 4.2) — The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains…
    CVE-2022-31649 (CVSS 7.5) — ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.…
    CVE-2021-35948 (CVSS 5.4) — Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to…

    References

    http://www.openwall.com/lists/oss-security/2012/08/11/1
    http://www.openwall.com/lists/oss-security/2012/09/02/2
    https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027
    https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5
    https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7
    https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438
    https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c
    https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606
    https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48
    https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254
    https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb
    http://www.openwall.com/lists/oss-security/2012/08/11/1
    http://www.openwall.com/lists/oss-security/2012/09/02/2
    https://github.com/owncloud/core/commit/44260a552cd4ee50ee11eee45164c725f56f7027
    https://github.com/owncloud/core/commit/642e7ce110cb8c320072532c29abe003385d50f5
    https://github.com/owncloud/core/commit/8f09299e2468dfc4f9ec72b05acf47de3ef9d1d7
    https://github.com/owncloud/core/commit/8f616ecf76aac4a8b554fbf5a90b1645d0f25438
    https://github.com/owncloud/core/commit/cc653a8a408adfb4d0cd532145668aacd85ad96c
    https://github.com/owncloud/core/commit/d294373f476c795aaee7dc2444e7edfdea01a606
    https://github.com/owncloud/core/commit/e817504569dce49fd7a677fa510e500394af0c48
    https://github.com/owncloud/core/commit/f8337c9d723039760eecccf68bcb02752551e254
    https://github.com/owncloud/core/commit/f955f6a6857754826af8903475688ba54f72c1bb

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High