Description
ownCloud 4.0.x before 4.0.10 and 4.5.x before 4.5.5 does not properly restrict access to settings.php, which allows remote attackers to edit app configurations of user_webdavauth and user_ldap by editing this file.
References
- https://github.com/owncloud/core/commit/c4ecbad
- 57030 vdb-entry
- https://github.com/owncloud/core/commit/db7ca53
- [oss-security] 20121221 Re: CVE request: ownCloud mailing-list
- http://owncloud.org/changelog/
- 51614 third-party-advisory
- owncloud-settings-sec-bypass(80808) vdb-entry
- [oss-security] 20121221 CVE request: ownCloud mailing-list