Unscored severity · published Oct 29, 2015
CVE-2015-5955
ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie…
–
CVSS
1.1%
EPSS
No
On KEV
Description
ownCloud iOS app before 3.4.4 does not properly switch state between multiple instances, which might allow remote instance administrators to obtain sensitive credential and cookie information by reading authentication headers.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Owncloud Client · Owncloud
before 3.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5955
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5955
Broken Link
https://owncloud.org/security/advisory/?id=oc-sa-2015-013
More from Owncloud Client
6.8
CVE-2022-25338
ownCloud owncloud/android before 2.20 has Incorrect Access Control for physically proximate attackers
5.5
CVE-2023-23948
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders
5.5
CVE-2022-25339
ownCloud owncloud/android 2.20 has Incorrect Access Control for local attackers
4.6
CVE-2020-36248
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature…
4.6
CVE-2020-36250
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past