CVE-2021-35948

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protection when they can force a target client to use a controlled cookie.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://doc.owncloud.com/server/admin_manual/release_notes.htmlRelease Notes, Vendor Advisory
https://owncloud.com/security-advisories/cve-2021-35948/Vendor Advisory
https://doc.owncloud.com/server/admin_manual/release_notes.htmlRelease Notes, Vendor Advisory
https://owncloud.com/security-advisories/cve-2021-35948/Vendor Advisory

Timeline

Published: Sep 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-359495.3The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and CVE-2021-35953.8An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() functi CVE-2021-359517.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via B CVE-2021-359525.3fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Chara CVE-2021-359537.5fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted c CVE-2021-359548.1fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious CVE-2021-359554.8Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7.CVE-2021-359565.4Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers CVE-2021-359576.7Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can re CVE-2021-359589.1TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extra CVE-2021-359595.4In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT t CVE-2021-35966.5A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due