CVE-2013-2039

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in lib/files/view.php in ownCloud before 4.0.15, 4.5.x 4.5.11, and 5.x before 5.0.6 allows remote authenticated users to access arbitrary files via unspecified vectors.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://owncloud.org/about/security/advisories/oC-SA-2013-020/Patch, Vendor Advisory
http://owncloud.org/about/security/advisories/oC-SA-2013-020/Patch, Vendor Advisory

Timeline

Published: Mar 14, 2014
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20403.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20413.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web CVE-2013-20423.5Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15, 4.5.x before 4.5.11, and 5.0.x before 5.0.6 allow remote auth CVE-2013-20434.0apps/calendar/ajax/events.php in ownCloud before 4.5.11 and 5.x before 5.0.6 does not properly check the ownership of a calendar, which allo CVE-2013-20445.8Open redirect vulnerability in the Login Page (index.php) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary we CVE-2013-20456.5SQL injection vulnerability in lib/db.php in ownCloud Server 5.0.x before 5.0.6 allows remote authenticated users to execute arbitrary SQL c CVE-2013-20466.5SQL injection vulnerability in lib/bookmarks.php in ownCloud Server 4.5.x before 4.5.11 and 5.x before 5.0.6 allows remote authenticated use CVE-2013-20472.1The login page (aka index.php) in ownCloud before 5.0.6 does not disable the autocomplete setting for the password parameter, which makes it CVE-2013-20486.5ownCloud before 5.0.6 does not properly check permissions, which allows remote authenticated users to execute arbitrary API commands via uns CVE-2013-20497.5Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static sec CVE-2013-20507.5SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virt CVE-2013-20512.6The Tomcat 6 DIGEST authentication functionality as used in Red Hat Enterprise Linux 6 allows remote attackers to bypass intended access res