Unscored severity · published Mar 14, 2014
CVE-2013-1822
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Owncloud Server · Owncloud
4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1822
Vendor Advisory
http://owncloud.org/about/security/advisories/oC-SA-2013-008/
More from Owncloud Server
9.8
CVE-2023-49105
ownCloud Improper Authentication Vulnerability
9.8
CVE-2014-2052
Zend Framework, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other…
8.5
CVE-2016-1499
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly…
6.5
CVE-2021-29659
ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure
6.5
CVE-2014-2050
Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote attackers to hijack the authentication of users for requests…