CVE-2012-5609

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.5.2 allows remote authenticated users to execute arbitrary PHP code by uploading a crafted mount.php file in a ZIP file.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://owncloud.org/changelog/
http://owncloud.org/security/advisories/oc-sa-2012-004/Patch, Vendor Advisory
http://secunia.com/advisories/51357Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/30/3
https://github.com/owncloud/core/commit/4619c66Patch
https://github.com/owncloud/core/commit/e8a0ceaPatch
http://owncloud.org/changelog/
http://owncloud.org/security/advisories/oc-sa-2012-004/Patch, Vendor Advisory
http://secunia.com/advisories/51357Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/30/3
https://github.com/owncloud/core/commit/4619c66Patch
https://github.com/owncloud/core/commit/e8a0ceaPatch

Timeline

Published: Dec 18, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-56106.5Incomplete blacklist vulnerability in lib/filesystem.php in ownCloud before 4.0.9 and 4.5.x before 4.5.2 allows remote authenticated users t CVE-2012-56116.5Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions CVE-2012-56126.5Heap-based buffer overflow in Oracle MySQL 5.5.19 and other versions through 5.5.28, and MariaDB 5.5.28a and possibly other versions, allows CVE-2012-56136.0MySQL 5.5.19 and possibly other versions, and MariaDB 5.5.28a and possibly other versions, when configured to assign the FILE privilege to u CVE-2012-56144.0Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier, and MariaDB 5.5.28a and possibly other versions, allows remote authenticated users t CVE-2012-56155.0Oracle MySQL 5.5.38 and earlier, 5.6.19 and earlier, and MariaDB 5.5.28a, 5.3.11, 5.2.13, 5.1.66, and possibly other versions, generates dif CVE-2012-56161.5Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform (formerly Citrix CloudStack) before 3.0.6 stores sensitive information in the lo CVE-2012-56177.8gksu-polkit: permissive PolicyKit policy configuration file allows privilege escalation CVE-2012-56189.8Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.CVE-2012-56192.1The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which .CVE-2012-56215.0lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL conn CVE-2012-56226.8Cross-site request forgery (CSRF) vulnerability in the management console (openshift-console/app/controllers/application_controller.rb) in O