Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

ownCloud bookmarks import can be tricked to run actions

CVE-2014-9041 · published 11 years ago
Summary

The bookmarks feature in ownCloud server versions before 5.0.18, 6.0.6, and 7.0.3 does not check a security token when importing data. This lets an attacker make a user unknowingly perform actions on behalf of the attacker. Update ownCloud to the latest version or apply the provided patches to stop the trick.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
owncloud owncloud <= 5.0.17
cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*
owncloud owncloud_server 5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
14 more version ranges
cpe:2.3:a:owncloud:owncloud_server:5.0.0:*:*:*:*:*:*:*
Original advisory text
The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct...
The import functionality in the bookmarks application in ownCloud server before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 does not validate CSRF tokens, which allow remote attackers to conduct CSRF attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published4 Feb 2015
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2014-9041 · NVD
Track software like this
Free during beta