CVE-2015-4715

medium

Description

The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.

References

Advisories
More

https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a

http://www.securityfocus.com/bid/76158

https://owncloud.org/security/advisory/?id=oc-sa-2015-005

https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/

Details

Source: Mitre, NVD

Published: 2020-02-17

Updated: 2025-03-31

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 4.9

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.01359