CVE-2012-4393 (PHP, published 2012-09-05T23:55Z)
Description: value: Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/owncloud/core
Files changed:
apps/bookmarks/ajax/addBookmark.php
apps/bookmarks/ajax/delBookmark.php
apps/bookmarks/ajax/editBookmark.php
apps/calendar/ajax/calendar/delete.php
apps/calendar/ajax/calendar/edit.php
apps/calendar/ajax/calendar/new.php
apps/calendar/ajax/calendar/update.php
apps/calendar/ajax/event/delete.php
apps/calendar/ajax/event/edit.php
apps/calendar/ajax/event/move.php
apps/calendar/ajax/event/new.php
apps/calendar/ajax/import/import.php
apps/calendar/ajax/settings/setfirstday.php
apps/calendar/ajax/settings/settimeformat.php
apps/calendar/ajax/share/changepermission.php
apps/calendar/ajax/share/share.php
apps/calendar/ajax/share/unshare.php
apps/external/ajax/setsites.php
apps/files/ajax/delete.php
apps/files/ajax/move.php
apps/files/ajax/newfile.php
apps/files/ajax/newfolder.php
apps/files/ajax/rename.php
apps/files_sharing/ajax/email.php
apps/files_sharing/ajax/setpermissions.php
apps/files_sharing/ajax/share.php
apps/files_sharing/ajax/toggleresharing.php
apps/files_sharing/ajax/togglesharewitheveryone.php
apps/files_sharing/ajax/unshare.php
apps/files_texteditor/ajax/savefile.php
apps/files_versions/ajax/rollbackVersion.php
apps/gallery/ajax/createAlbum.php
apps/gallery/ajax/sharing.php
apps/tasks/ajax/addtask.php
apps/tasks/ajax/addtaskform.php
apps/tasks/ajax/delete.php
apps/tasks/ajax/edittask.php
Commit message: Added CSRF checks


Vulnerable code:

Fixed code:
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();

OCP\JSON::callCheck();

 OCP\JSON::callCheck();

 OCP\JSON::callCheck();

 OCP\JSON::callCheck();

OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();

OCP\JSON::callCheck();

OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();
OCP\JSON::callCheck();