CVE-2015-6670

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-08-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-03T18:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-3373", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3373"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-6670", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-3373", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3373"}, {"name": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015", "refsource": "CONFIRM", "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T07:29:24.456Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-3373", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3373"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-6670", "datePublished": "2015-10-26T14:00:00.000Z", "dateReserved": "2015-08-25T00:00:00.000Z", "dateUpdated": "2024-08-06T07:29:24.456Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "8850D462-7494-40AF-BA58-91AB3EC4688E", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "C21CA18D-81F1-4B65-B46A-688D060F4E37", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "AFF45C5A-FA91-4908-9396-984FA6DBF80B", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "F0A9893F-0D5B-4DE5-B9D5-49AC2DA71BB8", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "7F50E0BD-53F6-4BF5-8EDE-77711DC2EB04", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4B2107C8-4A67-4889-94B7-9DA5BBD9CB3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "800BF17A-7C55-40A6-8421-261093611C57", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "1C9C1735-379E-4919-919D-871C7EA6F85D", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D554B7F-DEC4-4238-9346-CD1E3B1223E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "9E097A07-B9D8-4117-BCE5-32BCFF9905DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E52E7D8E-67EF-4EA9-9B3B-2E00F4A271C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "EADDA578-EDE7-42FD-B05F-64FA59733FF2", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "4F49D6F3-17C1-4731-828E-7A2B4A1A1260", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:8.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "43231F06-F9D3-4961-902B-96E3A807410B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ownCloud Server before 7.0.8, 8.0.x before 8.0.6, and 8.1.x before 8.1.1 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to apps/calendar/export.php."}, {"lang": "es", "value": "ownCloud Server en versiones anteriores a 7.0.8, 8.0.x en versiones anteriores a 8.0.6 y 8.1.x en versiones anteriores a 8.1.1 no verifica adecuadamente el propietario de los calendarios, lo que permite a usuarios remotos autenticados leer calendarios arbitrariamente a trav\u00e9s del par\u00e1metro calid en apps/calendar/export.php."}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/639.html\">CWE-639: Authorization Bypass Through User-Controlled Key</a>", "id": "CVE-2015-6670", "lastModified": "2026-06-17T00:31:13.020", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-10-26T14:59:09.577", "references": [{"source": "cve@mitre.org", "url": "http://www.debian.org/security/2015/dsa-3373"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2015-015"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}