VULNERABILITY INTELLIGENCE

CVE-2013-0304

CVSS score4 MEDIUM
EPSS probability1.00%
CISA KEVNot currently listed
Published2014-06-05
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:N/A:N

Description

ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.

Primary references