| Package | Affected versions | Patched versions |
|---|---|---|
| owncloud | ≤ 4.5.6 | |
| owncloud server | = 4.5.0= 4.5.1= 4.5.2= 4.5.3= 4.5.4= 4.5.5 |
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free