| Package | Affected versions | Patched versions |
|---|---|---|
| owncloud | ≤ 4.0.7 | |
| owncloud server | = 4.0.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6 |
lib/base.php in ownCloud before 4.0.8 does not properly validate the user_id session variable, which allows remote authenticated users to read arbitrary files via vectors related to WebDAV.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free