CVE-2021-35946

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://doc.owncloud.com/server/admin_manual/release_notes.htmlRelease Notes, Vendor Advisory
https://owncloud.com/security-advisories/cve-2021-35946/Vendor Advisory
https://doc.owncloud.com/server/admin_manual/release_notes.htmlRelease Notes, Vendor Advisory
https://owncloud.com/security-advisories/cve-2021-35946/Vendor Advisory

Timeline

Published: Sep 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-359475.3The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username CVE-2021-359485.4Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protectio CVE-2021-359495.3The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and CVE-2021-35953.8An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functi CVE-2021-359517.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via B CVE-2021-359525.3fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Chara CVE-2021-359537.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted c CVE-2021-359548.1fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious CVE-2021-359554.8Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.CVE-2021-359565.4Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers CVE-2021-359576.7Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can re CVE-2021-359589.1TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extra