The creators of the open-source file-sharing software ownCloud have
alerted users about three serious security vulnerabilities. These flaws could allow attackers to access confidential information and make changes to files.
Brief description of the vulnerabilities is as follows:
By infosecbulletin
/ Monday , March 31 2025
Canon has announced a critical security vulnerability, CVE-2025-1268, in printer drivers for its production printers, multifunction printers, and laser printers....
Read More
By infosecbulletin
/ Sunday , March 30 2025
RamiGPT is an AI security tool that targets root accounts. Using PwnTools and OpwnAI, it quickly navigated privilege escalation scenarios...
Read More
By infosecbulletin
/ Sunday , March 30 2025
Cybersecurity researcher Jeremiah Fowler recently revealed a sensitive data exposure involving the Australian fintech company Vroom by YouX, previously known...
Read More
By infosecbulletin
/ Sunday , March 30 2025
Safety Detectives' Cybersecurity Team found a forum post where a threat actor shared a .CSV file with over 200 million...
Read More
By infosecbulletin
/ Saturday , March 29 2025
The Federal Bureau of Investigation (FBI) is probing the cyberattack at Oracle (ORCL.N), opens new tab that has led to...
Read More
By infosecbulletin
/ Thursday , March 27 2025
OpenAI has increased its maximum bug bounty payout to $100,000, up from $20,000, to encourage the discovery of critical vulnerabilities...
Read More
By infosecbulletin
/ Thursday , March 27 2025
Splunk has released a security advisory about critical vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. These issues could lead...
Read More
By infosecbulletin
/ Thursday , March 27 2025
As the Eid holidays near, cybercriminals may try to take advantage of weakened security during this time. The CTI unit...
Read More
By infosecbulletin
/ Wednesday , March 26 2025
Operations at Kuala Lumpur International Airport (KLIA) were unaffected by a cyber attack in which hackers demanded US$10 million (S$13.4...
Read More
By infosecbulletin
/ Wednesday , March 26 2025
Unofficial patches are available for a new Windows zero-day vulnerability that allows remote attackers to steal NTLM credentials by deceiving...
Read More
Sensitive credentials and configuration in container deployments for graphapi versions 0.2.0 to 0.3.0 were exposed, leading to a security vulnerability with a CVSS score of 10.0.
WebDAV API authentication bypass through the use of pre-signed URLs affects core versions 10.6.0 to 10.13.0. This vulnerability has a CVSS score of 9.8.
Subdomain Validation Bypass impacting oauth2 prior to version 0.6.1 (CVSS score: 9.0)
“The first vulnerability involves the ‘graphapi’ app relying on a third-party library that exposes the PHP environment configuration details (phpinfo).”
“This information includes all the environment variables of the web server. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”
To fix the issue, ownCloud suggests removing the “owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php” file and disabling the ‘phpinfo’ function. Additionally, users are advised to update their ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys.
The second problem allows anyone to access, modify, or delete any file without needing authentication if they know the victim’s username and the victim hasn’t set up a signing-key, which is the default setting.
“Lastly, the third flaw relates to a case of improper access control that enables an attacker to redirect callbacks to a TLD controlled by the attacker without undergoing validation.”
Besides adding hardening measures to the validation code in the oauth2 app, ownCloud has suggested that users disable the “Allow Subdomains” option as a workaround.