medium4.0
CVE-2012-5336
lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files …
Impact
lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Owncloud | Owncloud | through 4.0.7 |
| Owncloud | Owncloud Server | Versions 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 |