CWE Code: 79
Vulnerability Type: privilege_escalation
CVSS Score: 2.1
CWE Name:  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary: multiple cross-site scripting (xss) vulnerabilities in owncloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or html via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or html via the (2) group field to settings.php or (3) "share with" field.
Access Authentication: SINGLE
Access Complexity: HIGH
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/NONE
Published Date: 2014-03-14
Last Modified Date: 2014-03-25