CVE-2014-9044

Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://owncloud.org/security/advisory/?id=oc-sa-2014-021	Vendor Advisory
https://owncloud.org/security/advisory/?id=oc-sa-2014-021	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:owncloud:owncloud_server:7.0.0:::::::*
	cpe:2.3:a:owncloud:owncloud_server:7.0.1:::::::*
	cpe:2.3:a:owncloud:owncloud_server:7.0.2:::::::*

History

31 Mar 2025, 11:54

Type	Values Removed	Values Added
First Time		Owncloud owncloud Server
CPE	cpe:2.3:a:owncloud:owncloud:7.0.2:::::::* cpe:2.3:a:owncloud:owncloud:7.0.1:::::::* cpe:2.3:a:owncloud:owncloud:7.0.0:::::::*	cpe:2.3:a:owncloud:owncloud_server:7.0.1:::::::* cpe:2.3:a:owncloud:owncloud_server:7.0.0:::::::* cpe:2.3:a:owncloud:owncloud_server:7.0.2:::::::*

21 Nov 2024, 02:20

Type	Values Removed	Values Added
References	~~() https://owncloud.org/security/advisory/?id=oc-sa-2014-021 - Vendor Advisory~~	() https://owncloud.org/security/advisory/?id=oc-sa-2014-021 - Vendor Advisory

Information

Published : 2015-02-04 18:59

Updated : 2025-03-31 11:54

NVD link : CVE-2014-9044

Mitre link : CVE-2014-9044

CVE.ORG link : CVE-2014-9044

JSON object : View

Products Affected

owncloud

owncloud_server

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-9044", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-02-04T18:59:04.387", "references": [{"url": "https://owncloud.org/security/advisory/?id=oc-sa-2014-021", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://owncloud.org/security/advisory/?id=oc-sa-2014-021", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Asset Pipeline in ownCloud 7.x before 7.0.3 uses an MD5 hash of the absolute file paths of the original CSS and JS files as the name of the concatenated file, which allows remote attackers to obtain sensitive information via a brute force attack."}, {"lang": "es", "value": "Asset Pipeline en ownCloud 7.x anterior a 7.0.3 utiliza un hash de MD5 de las rutas de ficheros absolutas de los ficheros originales de CSS y JS como el nombre del fichero concatenado, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de un ataque de fuerza bruta."}], "lastModified": "2025-03-31T11:54:18.823", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8850D462-7494-40AF-BA58-91AB3EC4688E"}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C21CA18D-81F1-4B65-B46A-688D060F4E37"}, {"criteria": "cpe:2.3:a:owncloud:owncloud_server:7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFF45C5A-FA91-4908-9396-984FA6DBF80B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}