The creators of the open-source file-sharing software ownCloud have
alerted users about three serious security vulnerabilities. These flaws could allow attackers to access confidential information and make changes to files.
Brief description of the vulnerabilities is as follows:
By infosecbulletin
/ Sunday , April 20 2025
You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...
Read More
By infosecbulletin
/ Saturday , April 19 2025
A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...
Read More
By infosecbulletin
/ Saturday , April 19 2025
GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...
Read More
By infosecbulletin
/ Friday , April 18 2025
Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
By infosecbulletin
/ Friday , April 18 2025
According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
By infosecbulletin
/ Friday , April 18 2025
A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
By infosecbulletin
/ Thursday , April 17 2025
On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
By infosecbulletin
/ Thursday , April 17 2025
Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
By infosecbulletin
/ Thursday , April 17 2025
On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
By infosecbulletin
/ Wednesday , April 16 2025
On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
Sensitive credentials and configuration in container deployments for graphapi versions 0.2.0 to 0.3.0 were exposed, leading to a security vulnerability with a CVSS score of 10.0.
WebDAV API authentication bypass through the use of pre-signed URLs affects core versions 10.6.0 to 10.13.0. This vulnerability has a CVSS score of 9.8.
Subdomain Validation Bypass impacting oauth2 prior to version 0.6.1 (CVSS score: 9.0)
“The first vulnerability involves the ‘graphapi’ app relying on a third-party library that exposes the PHP environment configuration details (phpinfo).”
“This information includes all the environment variables of the web server. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key.”
To fix the issue, ownCloud suggests removing the “owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php” file and disabling the ‘phpinfo’ function. Additionally, users are advised to update their ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys.
The second problem allows anyone to access, modify, or delete any file without needing authentication if they know the victim’s username and the victim hasn’t set up a signing-key, which is the default setting.
“Lastly, the third flaw relates to a case of improper access control that enables an attacker to redirect callbacks to a TLD controlled by the attacker without undergoing validation.”
Besides adding hardening measures to the validation code in the oauth2 app, ownCloud has suggested that users disable the “Allow Subdomains” option as a workaround.