XSS vulnerability in user_webdavauth
Platform: ownCloud Server
Risk level: Medium
A cross-site scripting (XSS) vulnerability in ownCloud 4.5.x before 4.5.2 allow remote attackers to inject arbitrary web script or HTML via the POST data to settings.php in apps/user_webdavauth/
- ownCloud Server < 4.5.2 (CVE-2012-5608)
It is recommended that all instances are upgraded to ownCloud Server 4.5.2.
The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:
- Lukas Reschke – ownCloud Inc. (email@example.com) – Vulnerability discovery and disclosure.