FreeBSD : owncloud -- multiple vulnerabilities (3166222b-c6a4-11e5-96d6-14dae9d210b8)

high Nessus Plugin ID 88500

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Owncloud reports :

- Reflected XSS in OCS provider discovery (oC-SA-2016-001)

- Information Exposure Through Directory Listing in the file scanner (oC-SA-2016-002)

- Disclosure of files that begin with '.v' due to unchecked return value (oC-SA-2016-003)

Solution

Update the affected package.

See Also

http://www.nessus.org/u?3359cf98

https://owncloud.org/security/advisories/

http://www.nessus.org/u?03482837

Plugin Details

Severity: High

ID: 88500

File Name: freebsd_pkg_3166222bc6a411e596d614dae9d210b8.nasl

Version: 2.5

Type: local

Published: 2/1/2016

Updated: 1/4/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:C

CVSS v3

Risk Factor: High

Base Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:owncloud, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 1/29/2016

Vulnerability Publication Date: 12/23/2015

Reference Information

CVE: CVE-2016-1498, CVE-2016-1499, CVE-2016-1500