Critical · published November 22, 2023
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.
🚨 A known username is all an attacker needs to waltz right in and mess with your files! 🔥 It's like a hotel that lets anyone into your room just because they correctly say your name at the front desk — no need for a room key at all! An attacker could access, modify, or even delete any file belonging to the victim without breaking a sweat. This could result in data loss, unauthorized changes, or complete chaos depending on the files involved. This type of vulnerability can be absolutely devastating for users who believe their data is secure.
It's like a hotel that lets anyone into your room just because they correctly say your name at the front desk — no need for a room key at all! This vulnerability allows attackers to exploit pre-signed URLs by bypassing authentication checks if the victim's username is known and they lack a signing key. As a result, any file can be accessed or modified without the owner's consent.
An attacker could access, modify, or even delete any file belonging to the victim without breaking a sweat. This could result in data loss, unauthorized changes, or complete chaos depending on the files involved. This type of vulnerability can be absolutely devastating for users who believe their data is secure. Upgrade ownCloud to version 10.13.1 or later immediately. Additionally, configure signing keys for users to add an extra layer of protection. Don't forget to review your current user permissions to ensure they're properly set up! You've got this! Follow these steps, and you'll tighten up security in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| owncloud/owncloud_server | ≥ 10.6.0, < 10.13.1 | 10.13.1 |