CVE-2014-2044

Description

Incomplete blacklist vulnerability in ajax/upload.php in ownCloud before 5.0, when running on Windows, allows remote authenticated users to bypass intended access restrictions, upload files with arbitrary names, and execute arbitrary code via an Alternate Data Stream (ADS) syntax in the filename parameter, as demonstrated using .htaccess::$DATA to upload a PHP program.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/91757

http://www.securityfocus.com/bid/66000

http://www.securityfocus.com/archive/1/531365/100/0/threaded

http://www.osvdb.org/104082

http://secunia.com/advisories/57267

http://seclists.org/fulldisclosure/2014/Mar/45

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS