CVE-2012-5607

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The "Lost Password" reset functionality in ownCloud before 4.0.9 and 4.5.0 does not properly check the security token, which allows remote attackers to change an accounts password via unspecified vectors related to a "Remote Timing Attack."

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://owncloud.org/changelog/
http://owncloud.org/security/advisories/oc-sa-2012-002/Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/30/3Patch
https://github.com/owncloud/core/commit/99cd922Patch
http://owncloud.org/changelog/
http://owncloud.org/security/advisories/oc-sa-2012-002/Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/30/3Patch
https://github.com/owncloud/core/commit/99cd922Patch

Timeline

Published: Dec 18, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56084.3Cross-site scripting (XSS) vulnerability in apps/user_webdavauth/settings.php in ownCloud 4.5.x before 4.5.2 allows remote attackers to inje CVE-2012-56096.5Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP co CVE-2012-56106.5Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users t CVE-2012-56116.5Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions CVE-2012-56126.5Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows CVE-2012-56136.0MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to u CVE-2012-56144.0Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users t CVE-2012-56155.0Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates dif CVE-2012-56161.5Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the lo CVE-2012-56177.8gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation CVE-2012-56189.8Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.CVE-2012-56192.1The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which .