Platform: ownCloud Server
Risk level: Medium
Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.
- ownCloud Server < 4.0.3 (CVE-2012-4395)
It is recommended that all instances are upgraded to ownCloud Server 4.0.3.
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Lukas Reschke – ownCloud Inc. (firstname.lastname@example.org) – Vulnerability discovery and disclosure.