CVE-2020-28645

Deleting users with certain names caused system files to be deleted

published February 9, 2021

CVSS
—
EPSS
1%
Percentile
68.9
In the wild
Unconfirmed
What it is

🚨 Deleting specific users could lead to catastrophic file loss — it’s like accidentally throwing out the wrong box during spring cleaning! ⚠️ Picture a janitor who unintentionally tosses out important documents while cleaning out a cluttered office. Deleting users with certain names in ownCloud/core can lead to critical system files being swept away, much like losing essential paperwork that can’t be replaced. The consequences could be absolutely devastating! If a user with a specific name is deleted, the system might also delete crucial files, potentially crashing your whole setup. This could leave your data vulnerable and disruptions in service.

Put simply

Picture a janitor who unintentionally tosses out important documents while cleaning out a cluttered office. Deleting users with certain names in ownCloud/core can lead to critical system files being swept away, much like losing essential paperwork that can’t be replaced. This vulnerability occurs when users with specific names are deleted, inadvertently triggering the deletion of system files due to a flaw in the user management process. It primarily affects ownCloud/core versions prior to 10.6.

What to do

The consequences could be absolutely devastating! If a user with a specific name is deleted, the system might also delete crucial files, potentially crashing your whole setup. This could leave your data vulnerable and disruptions in service. To remediate this issue, upgrade to ownCloud/core version 10.6 or later to patch the flaw. Additionally, review user deletion procedures and restrict self-registration where possible to minimize risk. You've got this! Taking these steps will help you secure your system effectively! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01240 · 68.9th percentile
Published
2021-02-09T18:41Z
EPSS history
Timeline
  • 09 FEB 18:41Z
    Deleting users with certain names caused system files to be deleted
    cvelistv5